Reactive

Spring Security 5

Workshop

https://andifalk.github.io/reactive-spring-security-5-workshop

The

Reactive Spring Security Workshop

https://andifalk.github.io/reactive-spring-security-5-workshop https://github.com/andifalk/reactive-spring-security-5-workshop

Part 1

Introduction to Reactive Programming
Spring Security Basics
Spring Security Practice (Hands-On) Part 1

Authentication
Password Security & Upgrades

Lunch-Break

Reactive Systems

— reactivemanifesto.org

Publisher

package org.reactivestreams;

public interface Publisher<T> {
    public void subscribe(Subscriber<? super T> s);
}

Subscriber

package org.reactivestreams;

public interface Subscriber<T> {
    public void onSubscribe(Subscription s);
    public void onNext(T t);
    public void onError(Throwable t);
    public void onComplete();
}

Subscription

package org.reactivestreams;

public interface Subscription {
    public void request(long n);
    public void cancel();
}

Processor

package org.reactivestreams;

public interface Processor<T, R> extends
         Subscriber<T>, Publisher<R> {}

Imperative vs. Reactive

Imperative

String msg = "World";
String upperCaseMsg = msg.toUpperCase();
String greeting = "Hello " + upperCaseMsg + "!";
System.out.println(greeting);

Reactive

Mono.just("World")
    .map(String::toUpperCase)
    .map(um -> "Hello " + um + "!")
    .subscribe(System.out::println);

Security Dependencies

Servlet Web Stack

...
implementation
  'org.springframework.boot:spring-boot-starter-security'
implementation
  'org.springframework.boot:spring-boot-starter-web'
...

Configuration

Servlet Web Stack

@Configuration
public class WebSecurityConfiguration
    extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http)
                       throws Exception {
    http.authorizeRequests()
            .anyRequest()
            .authenticated()
            .and()
            .httpBasic().and().formLogin();
  }
}

Security Dependencies

Reactive Web Stack

...
implementation
  'org.springframework.boot:spring-boot-starter-security'
implementation
  'org.springframework.boot:spring-boot-starter-webflux'
...

Configuration

Reactive Web Stack

@Configuration
@EnableWebFluxSecurity
public class ReactiveWebSecurityConfiguration {

  @Bean
  SecurityWebFilterChain
        securityWebFilterChain(ServerHttpSecurity http) {
    return http.authorizeExchange()
            .anyExchange()
            .authenticated()
            .and()
            .httpBasic().and().formLogin().and().build();
  }
}

Client Type	Flow	Refresh Tokens
Confidential	Authorization Code	X
Public (Native)	Authorization Code (PKCE)	X
Public (SPA)	Implicit	--
Trusted	RO Password Creds	X
No Resource Owner	Client Credentials	--

Client Type	Flow	Refresh Tokens
Confidential	Authorization Code (PKCE)	X
Public (Native)	Authorization Code (PKCE)	X
Public (SPA)	Authorization Code (PKCE)	--
Trusted	RO Password Creds	X
No Resource Owner	Client Credentials	--

ID Token

JSON Web token (JWT)

Base 64 Encoded JSON Formatted Value of...

...Header

...Payload

...Signature

GET / HTTP/1.1
Host: localhost:8080
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1N...

JSON Web Token (JWT)

Header

{
  typ: "JWT",
  alg: "RS256"
}

Payload

{
  iss: "https://identity.example.com",
  aud: "my-client-id",
  exp: 1495782385,
  nonce: "N0.46824857243233511495739124749",
  iat: 1495739185,
  at_hash: "hC1NDSB8WZ9SnjXTid175A",
  sub: "mysubject",
  auth_time: 1495739185,
  email: "test@gmail.com"
}

Scope	Required	Description
iss	X	Issuer Identifier
sub	X	Subject Identifier
aud	X	Audience(s) of this ID Token
exp	X	Expiration time
iat	X	Time at which the JWT was issued
auth_time	(X)	Time of End-User authentication
nonce	--	Associate a client with an ID Token

User Info Endpoint

GET /userinfo HTTP/1.1
Host: identityserver.example.com
Authorization: Bearer SlAV32hkKG

HTTP/1.1 200 OK
Content-Type: application/json

{
 "sub": "248289761001",
 "name": "Jane Doe",
 "given_name": "Jane",
 "family_name": "Doe",
 "preferred_username": "j.doe",
 "email": "janedoe@example.com",
 "picture": "http://example.com/janedoe/me.jpg"
}

OpenID Connect 1.0 Configuration

https://idp.example.com/.well-known/openid-configuration

{
  "authorization_endpoint": "https://idp.example.com/auth",
  "grant_types_supported": [
      "authorization_code",
      "implicit",
      "refresh_token"
  ],
  "issuer": "https://idp.example.com",
  "jwks_uri": "https://idp.example.com/keys",
  "token_endpoint": "https://idp.example.com/token",
  "userinfo_endpoint": "https://idp.example.com/userinfo",
  ...
}

OpenID Connect Discovery 1.0

Starting Keycloak

...on Linux/Mac OS

[keycloak_install_dir]/bin/standalone.sh

...on Windows

[keycloak_install_dir]\bin\standalone.bat

OAuth 2.0 Token Introspection

Opaque Tokens

class ResSrvConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http)
            throws Exception {
        http.oauth2ResourceServer()
                .opaqueToken()
                    .introspectionUri(this.introspectionUri)
                    .introspectionClientCredentials(
                        this.clientId, this.clientSecret);
    }
}

https://github.com/spring-projects/spring-security/issues/5200

Resource Server Multi-tenancy

class ResSrvConfig extends WebSecurityConfigurerAdapter {

    @Override protected void configure(HttpSecurity http) {
        http.oauth2ResourceServer()
            .authenticationManagerResolver(
                multitenantAuthenticationManager());
    }

    @Bean AuthenticationManagerResolver<HttpServletRequest>
        multiTenantAuthMgr() {...}

    AuthenticationManager jwt() {...}
    AuthenticationManager opaque() {...}
}

https://github.com/spring-projects/spring-security/issues/5351
https://github.com/spring-projects/spring-security/issues/6727

Use symmetric keys with JwtDecoder

class ResSrvConfig extends WebSecurityConfigurerAdapter {

  @Value("${spring.security.oauth2.resourceserver.
                jwt.key-value}") RSAPublicKey key;

  @Override protected void configure(HttpSecurity http) {
    http.oauth2ResourceServer().jwt().decoder(jwtDecoder());
  }

  @Bean JwtDecoder jwtDecoder() throws Exception {
      return NimbusJwtDecoder.
              withPublicKey(this.key).build();
  }
}

https://github.com/spring-projects/spring-security/issues/5465

JWT Flow API in Test Support

public class OAuth2ResourceServerTest {

    @Test
    public void testRequestPostProcessor() {
      mockMvc.perform(get("/message")
      .with(mockAccessToken().scope("message:read")))
      .andExpect(status().isOk())

      mockMvc.perform(get("/")
      .with(jwt().claim(SUB, "the-subject")))
      .andExpect(status().isOk())
    }
}

https://github.com/spring-projects/spring-security/issues/6634