https://github.com/pawel-piwowar/oauth2-demo

Oauth2 Demo with Spring Boot 2, spring-security-oauth2 and WebFlux
https://github.com/pawel-piwowar/oauth2-demo

aouth2 oauth2-demo sprin-security spring-boot-2 spring-security-oauth2 webflux

Last synced: about 1 month ago
JSON representation

Oauth2 Demo with Spring Boot 2, spring-security-oauth2 and WebFlux

• Host: GitHub
• URL: https://github.com/pawel-piwowar/oauth2-demo
• Owner: pawel-piwowar
• Created: 2019-12-25T19:19:11.000Z (almost 5 years ago)
• Default Branch: master
• Last Pushed: 2019-12-30T12:34:09.000Z (almost 5 years ago)
• Last Synced: 2024-07-27T08:34:50.952Z (5 months ago)
• Topics: aouth2, oauth2-demo, sprin-security, spring-boot-2, spring-security-oauth2, webflux
• Language: Java
• Homepage:
• Size: 135 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
## Oauth2 Demo with Spring Boot 2 and WebFlux

### Actors

- "Resource Application" ( oauth2-demo-resource-app,  localhost:8080) has protected resource: http://localhost:8080/api/accounts/default (account data) which can only be accessed by authorized users. 

- "Authorization Server" (oauth2-demo-auth-server, localhost:8082) is configured for authorization of "Resource Application".

Single user "demo" is defined with role "USER". 

- "Client Application" (oauth2-demo-client-app, http://localhost:8081) wants to retrieve user account data from "Resource Application". (for example to validate user credibility)

- User who has his account data in "Resource Application" and is using "Client Application"  

### Scenario

![login](./docs/oauth-demo.png)  

- User is visiting "Client Application" (1)

- After user confirmation (2), redirect is made to "Authorization Server" (3)

```

http://localhost:8082/oauth/authorize?client_id=demo-client-app&response_type=code&scope=read_account

```

- User has to login (user: "demo", pass:"123456") (4,5).   

![login](./docs/auth-server-login.png)  

- Than he may accept (or reject) giving access to his account data to "Client Application" (6,7)

![approval](./docs/auth-server-approval.png)  

- After user acceptance, redirect is made back to "Client Application" with temporary access code (8)   

```

http://localhost:8081/api/oauth2/account?code=[code]

```

- In order to get access token, "Client Application" makes call to "Authorization Server" using separate HTTP connection (acting as HTTP client) (9).

 "Client Application" is authenticating itself in "Authorization Server" using login "demo-client-app" and pass: "123456"

```

    POST http://localhost:8082/oauth/token  

    Headers:

    Content-Type: application/x-www-form-urlencoded

    Authorization: Basic ZGVtby1jbGllbnQtYXBwOjEyMzQ1Ng==  

    Parameters:

    grant_type=authorization_code  

    code=[code from redirect]  

    redirect_uri=http://localhost:8081/api/oauth2/account  

```

response with access token value: 

```json

{       "access_token": "44aa81f8-fe2f-4b08-bde2-4cd7e86fe189",

        "token_type": "bearer",

        "refresh_token": "[another_access_token_value]",

        "expires_in": 4815,

        "scope": "read_account" }

```

- Now "Client Application" (still using separate HTTP connection) makes call to "Resource Application" for REST resource "api/accounts/default",

token value is sent for authorization as header parameter (10). 

```    

    GET http://localhost:8080/api/accounts/default  

    Headers:  

    authorization:Bearer 44aa81f8-fe2f-4b08-bde2-4cd7e86fe189

```  

On this stage "Resource Application" makes call to "Authorization Server" for token validation (11),

address: "http://localhost:8082/oauth/check_token" (this call is made by spring-security-oauth2 without user browser redirects), 

after successful token validation, response is returned to "Client Application" (12):

```json

{ "accountNumber":"3435656777565677",

 "accountName":"Saving account",

 "balance":45.67 }

```

- This response containing account data JSON is sent to client browser (it is response for previous redirect: http://localhost:8081/api/oauth2/account?code=[code] ) (13).

![approval](./docs/account-data.png)  

Please note, that token value is never sent using client Internet browser. Separate connection is used instead,

where oauth2-demo-client-app application acts as http client. In this demo WebClient from Spring Webflux is used.  

Class : [com.pp.oauth2.demo.client.app.connector.Oauth2Connector](./oauth2-demo-client-app/src/main/java/com/pp/oauth2/demo/client/app/connector/Oauth2Connector.java)  

(user account data is also transferred through this separate connection, it could be sent back to client browser or not)  

Alternatively client application could be created using spring-security-oauth2-client.

### Running the demo

1. Install java 1.8 or higher, maven 3.3

2. Run "mvn clean install" from root directory of the project

3. Start applications by typing : "mvn spring-boot:run" in oauth2-demo-resource-app, oauth2-demo-client-app and oauth2-demo-auth-server directories.

This will start three applications on ports 8080, 8081 and 8082 respectively  

4. Type http://localhost:8081 in web browser

Points 2-4 could be executed using "run.bat" script from root directory of the project.

### Resources 

- https://github.com/endymuhardin/belajar-springoauth2

- https://howtodoinjava.com/spring-boot2/oauth2-auth-server

- https://pattern-match.com/blog/2018/10/17/springboot2-with-oauth2-integration

- https://docs.spring.io/spring-security-oauth2-boot/docs/current/reference/htmlsingle

- https://docs.spring.io/spring/docs/current/spring-framework-reference/web-reactive.html

### Comments

In case of any problems/questions fell free to create issue here: https://github.com/pawel-piwowar/oauth2-demo/issues