Context - Spring + OAuth2
oauth2Login() method:
This method configures OAuth 2.0 login in Spring Security, allowing users to authenticate with third-party providers like Amazon Cognito, Google, Facebook, GitHub, etc. It implements OAuth 2.0 flow where users are redirected to an external provider for authentication. It uses the authorization code flow to obtain tokens for the client. Session management is done by storing the authentication in the session (stateful), though it can be configured to work with stateless setups using tokens.
Securing the ID Token
Ensure the receiving service (profile service) verifies the audience (aud) claim of the ID token to confirm it was intended for profile service.
ID tokens have expiration times (exp claim). Ensure the profile service checks that the token hasn't expired before accepting it.
Verify the ID token’s signature using the public keys from Cognito’s JWKS endpoint to ensure it hasn't been tampered with.
Current (Keycloak) Auth Flow
...
Retrieve the appropriate claim from the token to be matched with the username in the profile service
Verify the user exists, and retrieve the user’s roles and principles for authorization
Set the calling service’s security context with the retrieved authorities (do we want to do this?)#
A high level idea of this can be seen below:
...
SharedAuthencticationSuccessHandler
(implements AuthenticationSuccessHandler
) (needs new name)Instantiated with following dependencies/params:
SecurityContext
(is this bad?) - for setting granted authoritiesJwtUtil
(another shared component, see below) - for decoding token to retrieve user detailsUserDetailsService
- for retrieving user details
Does the following in its
onAuthenticationSuccess
method:Decodes token to find username (email) using
JwtUtil
Fetches user details from
UserDetailsService
Extracts granted authorities from
UserInfo
and sets them inSecurityContext
Authorization can now be performed on controllers etc within the calling service
JwtUtil
class (again, needs a better name)Instantiated with the following dependencies/params:
jwkSetUri
String configured as an application propertyjwtIssuer
String configured as an application propertyusernameClaim
String configured as an application property (this is because we use email as the username)creates a
NimbusJwtDecoder
Bean fromjwkSetUri
andjwtIssuer
Does the following:
Method to retrieve the username from the token
UserDetailsService
- Already exists, fetches user infor by user name
...