Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Simplify Multitenancy Example

Browse Source 
Closes gh-8713
This commit is contained in:
Josh Cummings
2020-06-17 14:04:45 -06:00
parent 145bb89394
commit 9895d01257
6 changed files with 121 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
samples/boot/oauth2resourceserver-multitenancy/src/main/java/sample/OAuth2ResourceServerController.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@ package sample;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RestController;
/**
@@ -27,14 +27,14 @@ import org.springframework.web.bind.annotation.RestController;
@RestController
public class OAuth2ResourceServerController {
@GetMapping("/{tenantId}")
public String index(@AuthenticationPrincipal OAuth2AuthenticatedPrincipal token, @PathVariable("tenantId") String tenantId) {
@GetMapping("/")
public String index(@AuthenticationPrincipal OAuth2AuthenticatedPrincipal token, @RequestHeader("tenant") String tenant) {
String subject = token.getAttribute("sub");
return String.format("Hello, %s for %s!", subject, tenantId);
return String.format("Hello, %s for tenant %s!", subject, tenant);
}
@GetMapping("/{tenantId}/message")
public String message(@PathVariable("tenantId") String tenantId) {
return String.format("secret message for %s", tenantId);
@GetMapping("/message")
public String message(@RequestHeader("tenant") String tenant) {
return String.format("secret message for tenant %s", tenant);
}
}

69
samples/boot/oauth2resourceserver-multitenancy/src/main/java/sample/OAuth2ResourceServerSecurityConfiguration.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -15,25 +15,13 @@
*/
package sample;
import java.util.HashMap;
import java.util.Map;
import java.util.Optional;
import javax.servlet.http.HttpServletRequest;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManagerResolver;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.authentication.JwtBearerTokenAuthenticationConverter;
import org.springframework.security.oauth2.server.resource.authentication.OpaqueTokenAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.introspection.NimbusOpaqueTokenIntrospector;
import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
/**
* @author Josh Cummings
@@ -41,59 +29,20 @@ import org.springframework.security.oauth2.server.resource.introspection.OpaqueT
@EnableWebSecurity
public class OAuth2ResourceServerSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Value("${tenantOne.jwk-set-uri}")
String jwkSetUri;
@Value("${tenantTwo.introspection-uri}")
String introspectionUri;
@Value("${tenantTwo.introspection-client-id}")
String introspectionClientId;
@Value("${tenantTwo.introspection-client-secret}")
String introspectionClientSecret;
@Autowired
AuthenticationManagerResolver<HttpServletRequest> authenticationManagerResolver;
@Override
protected void configure(HttpSecurity http) throws Exception {
// @formatter:off
http
.authorizeRequests(authorizeRequests ->
authorizeRequests
.antMatchers("/**/message/**").hasAuthority("SCOPE_message:read")
.anyRequest().authenticated()
.authorizeRequests(authz -> authz
.antMatchers("/message/**").hasAuthority("SCOPE_message:read")
.anyRequest().authenticated()
)
.oauth2ResourceServer(oauth2ResourceServer ->
oauth2ResourceServer
.authenticationManagerResolver(multitenantAuthenticationManager())
.oauth2ResourceServer(oauth2 -> oauth2
.authenticationManagerResolver(this.authenticationManagerResolver)
);
// @formatter:on
}
@Bean
AuthenticationManagerResolver<HttpServletRequest> multitenantAuthenticationManager() {
Map<String, AuthenticationManager> authenticationManagers = new HashMap<>();
authenticationManagers.put("tenantOne", jwt());
authenticationManagers.put("tenantTwo", opaque());
return request -> {
String[] pathParts = request.getRequestURI().split("/");
String tenantId = pathParts.length > 0 ? pathParts[1] : null;
return Optional.ofNullable(tenantId)
.map(authenticationManagers::get)
.orElseThrow(() -> new IllegalArgumentException("unknown tenant"));
};
}
AuthenticationManager jwt() {
JwtDecoder jwtDecoder = NimbusJwtDecoder.withJwkSetUri(this.jwkSetUri).build();
JwtAuthenticationProvider authenticationProvider = new JwtAuthenticationProvider(jwtDecoder);
authenticationProvider.setJwtAuthenticationConverter(new JwtBearerTokenAuthenticationConverter());
return authenticationProvider::authenticate;
}
AuthenticationManager opaque() {
OpaqueTokenIntrospector introspectionClient =
new NimbusOpaqueTokenIntrospector(this.introspectionUri,
this.introspectionClientId, this.introspectionClientSecret);
return new OpaqueTokenAuthenticationProvider(introspectionClient)::authenticate;
}
}

58
samples/boot/oauth2resourceserver-multitenancy/src/main/java/sample/TenantAuthenticationManagerResolver.java Normal file
View File

@@ -0,0 +1,58 @@
/*
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package sample;
import javax.servlet.http.HttpServletRequest;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationManagerResolver;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.authentication.JwtBearerTokenAuthenticationConverter;
import org.springframework.security.oauth2.server.resource.authentication.OpaqueTokenAuthenticationProvider;
import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
import org.springframework.stereotype.Component;
@Component
public class TenantAuthenticationManagerResolver
implements AuthenticationManagerResolver<HttpServletRequest> {
private AuthenticationManager jwt;
private AuthenticationManager opaqueToken;
public TenantAuthenticationManagerResolver(
JwtDecoder jwtDecoder, OpaqueTokenIntrospector opaqueTokenIntrospector) {
JwtAuthenticationProvider jwtAuthenticationProvider = new JwtAuthenticationProvider(jwtDecoder);
jwtAuthenticationProvider.setJwtAuthenticationConverter(new JwtBearerTokenAuthenticationConverter());
this.jwt = new ProviderManager(jwtAuthenticationProvider);
this.opaqueToken = new ProviderManager(new OpaqueTokenAuthenticationProvider(opaqueTokenIntrospector));
}
@Override
public AuthenticationManager resolve(HttpServletRequest request) {
String tenant = request.getHeader("tenant");
if ("one".equals(tenant)) {
return this.jwt;
}
if ("two".equals(tenant)) {
return this.opaqueToken;
}
throw new IllegalArgumentException("unknown tenant");
}
}

14
samples/boot/oauth2resourceserver-multitenancy/src/main/resources/application.yml
View File

@@ -1,4 +1,10 @@
tenantOne.jwk-set-uri: ${mockwebserver.url}/.well-known/jwks.json
tenantTwo.introspection-uri: ${mockwebserver.url}/introspect
tenantTwo.introspection-client-id: client
tenantTwo.introspection-client-secret: secret
spring:
security:
oauth2:
resourceserver:
jwt:
jwk-set-uri: ${mockwebserver.url}/.well-known/jwks.json
opaquetoken:
introspection-uri: ${mockwebserver.url}/introspect
client-id: client
client-secret: secret