Spring Boot: prihlásenie OpenID Connect so Spring Security

Prihlásenie cez Dazr Identity: bezplatné OpenID Connect hostované v EÚ, s passkeys, kódmi e-mailom a účtami Google alebo Microsoft pod jedným tlačidlom.

Potrebujete tri hodnoty z vývojárskej konzoly: ID klienta, tajný kľúč klienta (len pri webových serverových aplikáciách) a URI presmerovania, ktoré ste zaregistrovali. Všetko ostatné je v dokumente discovery na adrese https://identity.dazr.eu/.well-known/openid-configuration.

Spring Boot (Spring Security)

Prihlásenie OAuth 2.0 v Spring Security (Spring Boot 3, spring-boot-starter-oauth2-client) číta discovery dokument. Dva doplnky: Spring predvolene očakáva ID tokeny RS256, takže mu dajte decoder factory pre ES256, a PKCE posiela len pre verejných klientov, takže PKCE zapnite pre svoju serverovú aplikáciu. Zaregistrujte URI presmerovania https://app.example.eu/login/oauth2/code/dazr.

# application.yml
spring:
  security:
    oauth2:
      client:
        registration:
          dazr:
            provider: dazr
            client-id: ${DAZR_CLIENT_ID}
            client-secret: ${DAZR_CLIENT_SECRET}
            client-authentication-method: client_secret_basic
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope: openid,profile,email
        provider:
          dazr:
            issuer-uri: https://identity.dazr.eu
            user-name-attribute: sub

// SecurityConfig.java
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.client.oidc.authentication.OidcIdTokenDecoderFactory;
import org.springframework.security.oauth2.client.registration.ClientRegistration;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestCustomizers;
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
import org.springframework.security.oauth2.jwt.JwtDecoderFactory;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

  @Bean
  SecurityFilterChain security(HttpSecurity http, ClientRegistrationRepository clients) throws Exception {
    var resolver = new DefaultOAuth2AuthorizationRequestResolver(clients, "/oauth2/authorization");
    resolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce());
    http
      .authorizeHttpRequests(a -> a.requestMatchers("/", "/error").permitAll().anyRequest().authenticated())
      .oauth2Login(o -> o.authorizationEndpoint(e -> e.authorizationRequestResolver(resolver)));
    return http.build();
  }

  // Dazr Identity signs ID tokens with ES256.
  @Bean
  JwtDecoderFactory<ClientRegistration> idTokenDecoderFactory() {
    var factory = new OidcIdTokenDecoderFactory();
    factory.setJwsAlgorithmResolver(registration -> SignatureAlgorithm.ES256);
    return factory;
  }
}

Prihlásenie spustite na /oauth2/authorization/dazr. V controlleri dá @AuthenticationPrincipal OidcUser user hodnotu user.getSubject(), teda Dazr sub. Ak chcete prijímať prístupové tokeny Dazr v resource serveri, nastavte spring.security.oauth2.resourceserver.jwt.issuer-uri na https://identity.dazr.eu a jws-algorithms na ES256 a kontrolujte, že aud je vaše client ID.

Ďalšie informácie pre vývojárov

Dokumentácia pre vývojárovVšetci sprievodcovia integráciouĽubovoľná knižnica OpenID ConnectCeny