Securing Spring Microservice with OAuth 2.0

Bubu Tripathy — Mon, 02 Dec 2024 02:20:11 +0000

This tutorial is about setting up an OAuth 2.0 Authorization Server and securing microservices with token-based authentication and scope-based authorization using Spring Boot.

Step 1: Setting up the OAuth 2.0 Authorization Server

An OAuth 2.0 Authorization Server centralizes security, issuing access tokens for client applications to authenticate and authorize requests to microservices.

1.1 Adding Dependencies

To begin, include the spring-security-oauth2 and spring-boot-starter-security dependencies in your pom.xml. These provide essential libraries for configuring OAuth 2.0 capabilities and securing your Spring Boot application.

<dependency>
    <groupId>org.springframework.security.oauth</groupId>
    <artifactId>spring-security-oauth2</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

1.2 Configuring Application Properties

Next, configure the server to run on port 8081 by adding a few settings in the application.properties file. Enabling the OAuth 2.0 Authorization Server is done via spring.security.oauth2.authorizationserver.enabled=true.

server.port=8081
spring.security.oauth2.authorizationserver.enabled=true

This ensures the application starts on the specified port and sets up the authorization server.

1.3 Implementing the Authorization Server

Create a Java class annotated with @EnableAuthorizationServer to designate it as an authorization server. Extend AuthorizationServerConfigurerAdapter to configure clients and supported grant types. In this example, the client details are stored in memory using inMemory(). The client is identified by "client-id", secured with "client-secret", and supports the "password" and "refresh_token" grant types. It is further scoped to "read" and "write", defining the level of access the client has to resources.

import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;

@EnableAuthorizationServer
@Configuration
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
            .withClient("client-id")
            .secret("{noop}client-secret")
            .authorizedGrantTypes("password", "refresh_token")
            .scopes("read", "write");
    }
}

Step 2: Securing a Microservice as a Resource Server

A Resource Server is a microservice that validates access tokens and enforces access control.

2.1 Adding Dependencies

Include the spring-security-oauth2 dependency in the pom.xml of your microservice:

<dependency>
    <groupId>org.springframework.security.oauth</groupId>
    <artifactId>spring-security-oauth2</artifactId>
</dependency>

2.2 Configuring the Resource Server

To secure your microservice, annotate a configuration class with @EnableResourceServer. Extend ResourceServerConfigurerAdapter and override the configure(HttpSecurity http) method. Here, we configure the microservice to permit all requests to /public/** but require authentication for other endpoints.

import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;

@EnableResourceServer
@Configuration
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/public/**").permitAll()
            .anyRequest().authenticated();
    }
}

2.3 Validating Access Tokens

The resource server must validate the access tokens issued by the authorization server. Specify the token validation endpoint in the application.properties file:

security.oauth2.resource.token-info-uri=http://localhost:8081/oauth/check_token

This points the resource server to the authorization server’s /check_token endpoint for token verification.

Step 3: Enforcing Scope-Based Authorization

OAuth 2.0 allows fine-grained access control by using scopes. Scopes represent the level of access permitted to a resource.

Configuring Scope-Based Access

Spring Security annotations like @PreAuthorize can enforce scope-based access control at the method level. For example, the following OrderController class uses @PreAuthorize to allow access to getOrders only if the token contains the "read" scope. Similarly, the createOrder method requires the "write" scope.

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;

import java.util.List;

@RestController
@RequestMapping("/orders")
public class OrderController {

    @PreAuthorize("hasAuthority('SCOPE_read')")
    @GetMapping
    public List<Order> getOrders() {
        // Logic to fetch orders
        return List.of(new Order(1, "Sample Order"));
    }

    @PreAuthorize("hasAuthority('SCOPE_write')")
    @PostMapping
    public Order createOrder(@RequestBody Order order) {
        // Logic to create order
        return order;
    }
}

class Order {
    private int id;
    private String name;

    // Constructor, getters, and setters
    public Order(int id, String name) {
        this.id = id;
        this.name = name;
    }
}

Ensure that tokens include the required scopes in their payload, as shown below:

{
  "scope": ["read", "write"],
  "exp": 1700000000,
  "client_id": "client-id"
}

Step 4: Testing the Setup

4.1 Obtaining an Access Token

A client can obtain an access token by sending a POST request to the authorization server’s /oauth/token endpoint. Use the following curl command:

curl -X POST \
  -d "grant_type=password&username=user&password=pass" \
  -u "client-id:client-secret" \
  http://localhost:8081/oauth/token

The response includes the access_token and other token details:

{
  "access_token": "abc123",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "xyz789"
}

4.2 Accessing a Secured Endpoint

To access a secured microservice endpoint, include the access token in the Authorization header:

curl -H "Authorization: Bearer abc123" http://localhost:8080/orders

Conclusion

This tutorial demonstrates how to set up an OAuth 2.0 Authorization Server, secure microservices as resource servers, and enforce scope-based access control. By leveraging token-based authentication, you can centralize security management, improve scalability, and achieve fine-grained access control in a microservices architecture.

DEV Community: Bubu Tripathy