SpringBoot Security 15 : Securing WebApp

 ok

Whenever an ORG is trying to build an Auth servere there are 2 options

1. custom
2. product : keycloak (open src) , okta  , there are many on cloud as well (aws cognito)

https://www.keycloak.org/ can be used for

1. SSO
2. Identity Broker & Social Login
3. User Federation
4. + more 

What is a Keycloak : Realm ?

A Keycloak realm is an isolated management space, akin to a tenant, that manages a logical collection of users, credentials, roles, and groups

Convert Sprint Boot Application to a Resource Server

https://github.com/eazybytes/spring-security/blob/4.x.x/section_15/springsecsection_15/pom.xml

first : add dependency like below ( line number 43 ) 

< dependency >

            < groupId > org.springframework.boot < / groupId >

            < artifactId > spring-boot-starter-security-oauth2-resource-server < / artifactId >

< / dependency >

second : delete all authentication classes and user resource classes in config folder , because you dont want to use the existing DB authn mechnism

third : create KeyCloakRoleConverter class

responsibility of generating Access token or JWT token will be with key cloak. token has info of user , email and role details 

this class will take out info from access token and convert it into form of simple granted authority, because spring framework can only understand the roles and authorities information when we present them in form of granted authority or simple granted authority. ?????.

https://github.com/eazybytes/spring-security/blob/4.x.x/section_15/springsecsection_15/src/main/java/com/eazybytes/config/KeycloakRoleConverter.java

public class KeycloakRoleConverter implements Converter<Jwt, Collection<GrantedAuthority>> {

@Override

    public Collection<GrantedAuthority> convert(Jwt source) { 

... // convert JWT Token to collection of authority

    } 

}

then configure the KeyCloakRoleConverter in ProjectConfig.

https://github.com/eazybytes/spring-security/blob/4.x.x/section_15/springsecsection_15/src/main/java/com/eazybytes/config/ProjectSecurityConfig.java

@Bean

    SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {

        JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();

        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(new KeycloakRoleConverter());

...

http.oauth2ResourceServer(rsc -> rsc.jwt(jwtConfigurer ->

                jwtConfigurer.jwtAuthenticationConverter(jwtAuthenticationConverter)));

 ...

}

https://github.com/eazybytes/spring-security/blob/4.x.x/section_15/springsecsection_15/src/main/java/com/eazybytes/controller/AccountController.java

change param of method from id to email (from DB)

client app will look forward to get account details by email id 

https://github.com/eazybytes/spring-security/blob/4.x.x/section_15/springsecsection_15/src/main/resources/application.properties

spring.security.oauth2.resourceserver.jwt.jwk-set-uri=${JWK_SET_URI:http://localhost:8180/realms/eazybankdev/protocol/openid-connect/certs}

what is opaque token ?

https://stackoverflow.com/questions/59158410/what-is-an-opaque-token

implement new class https://github.com/eazybytes/spring-security/blob/4.x.x/section_15/springsecsection_15/src/main/java/com/eazybytes/config/KeycloakOpaqueRoleConverter.java

ok