Devops Monk

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-authorization-server</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@Configuration
@EnableWebSecurity
public class AuthorizationServerConfig {

    // Chain 1: Authorization server endpoints
    @Bean
    @Order(1)
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
            throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);

        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
            .oidc(Customizer.withDefaults()); // Enable OIDC (userinfo endpoint, etc.)

        http.exceptionHandling(ex -> ex
            .defaultAuthenticationEntryPointFor(
                new LoginUrlAuthenticationEntryPoint("/login"),
                new MediaTypeRequestMatcher(MediaType.TEXT_HTML)
            )
        );

        return http.build();
    }

    // Chain 2: Form login for users (the consent and login UI)
    @Bean
    @Order(2)
    public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .formLogin(Customizer.withDefaults());
        return http.build();
    }

    // The registered clients (who is allowed to request tokens)
    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        RegisteredClient webClient = RegisteredClient.withId(UUID.randomUUID().toString())
            .clientId("web-client")
            .clientSecret("{noop}web-secret")  // use BCrypt in production
            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
            .redirectUri("https://web.example.com/login/oauth2/code/my-auth-server")
            .postLogoutRedirectUri("https://web.example.com/")
            .scope(OidcScopes.OPENID)
            .scope(OidcScopes.PROFILE)
            .scope(OidcScopes.EMAIL)
            .scope("read:products")
            .clientSettings(ClientSettings.builder()
                .requireAuthorizationConsent(true)  // show consent screen
                .requireProofKey(true)              // require PKCE
                .build())
            .tokenSettings(TokenSettings.builder()
                .accessTokenTimeToLive(Duration.ofMinutes(15))
                .refreshTokenTimeToLive(Duration.ofDays(7))
                .reuseRefreshTokens(false)           // token rotation
                .build())
            .build();

        RegisteredClient serviceClient = RegisteredClient.withId(UUID.randomUUID().toString())
            .clientId("service-client")
            .clientSecret("{bcrypt}" + new BCryptPasswordEncoder().encode("service-secret"))
            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
            .scope("read:products")
            .scope("write:orders")
            .tokenSettings(TokenSettings.builder()
                .accessTokenTimeToLive(Duration.ofHours(1))
                .build())
            .build();

        return new InMemoryRegisteredClientRepository(webClient, serviceClient);
    }

    // JWK Set — key pair used to sign tokens
    @Bean
    public JWKSource<SecurityContext> jwkSource() {
        KeyPair keyPair = generateRsaKey();
        RSAPublicKey  publicKey  = (RSAPublicKey) keyPair.getPublic();
        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();

        RSAKey rsaKey = new RSAKey.Builder(publicKey)
            .privateKey(privateKey)
            .keyID(UUID.randomUUID().toString())
            .build();

        return new ImmutableJWKSet<>(new JWKSet(rsaKey));
    }

    private static KeyPair generateRsaKey() {
        try {
            KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
            generator.initialize(2048);
            return generator.generateKeyPair();
        } catch (Exception ex) {
            throw new IllegalStateException(ex);
        }
    }

    @Bean
    public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
        return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
    }

    @Bean
    public AuthorizationServerSettings authorizationServerSettings() {
        return AuthorizationServerSettings.builder()
            .issuer("https://auth.example.com")  // this server's URL
            .build();
    }
}

-- Required tables (Spring Authorization Server provides schema scripts)
CREATE TABLE oauth2_registered_client (
    id                             VARCHAR(100) NOT NULL PRIMARY KEY,
    client_id                      VARCHAR(100) NOT NULL UNIQUE,
    client_id_issued_at            TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL,
    client_secret                  VARCHAR(200),
    client_secret_expires_at       TIMESTAMP,
    client_name                    VARCHAR(200) NOT NULL,
    client_authentication_methods  VARCHAR(1000) NOT NULL,
    authorization_grant_types      VARCHAR(1000) NOT NULL,
    redirect_uris                  VARCHAR(1000),
    post_logout_redirect_uris      VARCHAR(1000),
    scopes                         VARCHAR(1000) NOT NULL,
    client_settings                VARCHAR(2000) NOT NULL,
    token_settings                 VARCHAR(2000) NOT NULL
);

-- Authorization + token tables (many more — use the provided schema)

@Bean
public RegisteredClientRepository registeredClientRepository(JdbcTemplate jdbcTemplate) {
    return new JdbcRegisteredClientRepository(jdbcTemplate);
}

@Bean
public OAuth2AuthorizationService authorizationService(
    JdbcTemplate jdbcTemplate,
    RegisteredClientRepository registeredClientRepository
) {
    return new JdbcOAuth2AuthorizationService(jdbcTemplate, registeredClientRepository);
}

@Bean
public OAuth2AuthorizationConsentService authorizationConsentService(
    JdbcTemplate jdbcTemplate,
    RegisteredClientRepository registeredClientRepository
) {
    return new JdbcOAuth2AuthorizationConsentService(jdbcTemplate, registeredClientRepository);
}

@Bean
public OAuth2TokenCustomizer<JwtEncodingContext> tokenCustomizer(UserRepository userRepository) {
    return context -> {
        if (context.getPrincipal() instanceof UsernamePasswordAuthenticationToken auth) {
            AppUserDetails user = (AppUserDetails) auth.getPrincipal();
            User dbUser = userRepository.findById(user.getId()).orElseThrow();

            // Add to access token
            if (OidcParameterNames.ID_TOKEN.equals(context.getTokenType().getValue())
                    || OAuth2TokenType.ACCESS_TOKEN.equals(context.getTokenType())) {
                context.getClaims()
                    .claim("userId", dbUser.getId())
                    .claim("email", dbUser.getEmail())
                    .claim("roles", dbUser.getRoles().stream().map(Role::name).toList());
            }

            // Add extra claims only to ID token
            if (OidcParameterNames.ID_TOKEN.equals(context.getTokenType().getValue())) {
                context.getClaims()
                    .claim("picture", dbUser.getAvatarUrl())
                    .claim("given_name", dbUser.getFirstName())
                    .claim("family_name", dbUser.getLastName());
            }
        }
    };
}

@Controller
public class ConsentController {

    private final OAuth2AuthorizationConsentService consentService;
    private final RegisteredClientRepository clientRepository;

    @GetMapping("/oauth2/consent")
    public String consent(
        @RequestParam String clientId,
        @RequestParam String scope,
        @RequestParam String state,
        @AuthenticationPrincipal Principal principal,
        Model model
    ) {
        RegisteredClient client = clientRepository.findByClientId(clientId);

        // Parse requested scopes and add descriptions
        Set<String> requestedScopes = Arrays.stream(scope.split(" ")).collect(toSet());
        Set<ScopeWithDescription> scopesWithDesc = requestedScopes.stream()
            .map(s -> new ScopeWithDescription(s, getScopeDescription(s)))
            .collect(toSet());

        model.addAttribute("clientName", client.getClientName());
        model.addAttribute("scopes", scopesWithDesc);
        model.addAttribute("state", state);
        model.addAttribute("clientId", clientId);
        model.addAttribute("username", principal.getName());
        return "consent"; // consent.html
    }

    private String getScopeDescription(String scope) {
        return switch (scope) {
            case "openid"        -> "Access your identity";
            case "profile"       -> "Read your name and profile";
            case "email"         -> "Read your email address";
            case "read:products" -> "Read products from our store";
            case "write:orders"  -> "Create orders on your behalf";
            default              -> scope;
        };
    }
}

http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
    .authorizationEndpoint(endpoint -> endpoint
        .consentPage("/oauth2/consent")  // use custom consent page
    );

# application.yml
app:
  security:
    jwk:
      key-store: /secrets/auth-server-keystore.p12
      key-store-password: ${KEY_STORE_PASSWORD}
      key-alias: auth-server-key

@Bean
public JWKSource<SecurityContext> jwkSource(
    @Value("${app.security.jwk.key-store}") Resource keyStore,
    @Value("${app.security.jwk.key-store-password}") String password,
    @Value("${app.security.jwk.key-alias}") String alias
) throws Exception {
    KeyStore ks = KeyStore.getInstance("PKCS12");
    try (InputStream is = keyStore.getInputStream()) {
        ks.load(is, password.toCharArray());
    }
    RSAPrivateKey privateKey = (RSAPrivateKey) ks.getKey(alias, password.toCharArray());
    RSAPublicKey  publicKey  = (RSAPublicKey) ks.getCertificate(alias).getPublicKey();

    RSAKey rsaKey = new RSAKey.Builder(publicKey).privateKey(privateKey)
        .keyID(alias).build();
    return new ImmutableJWKSet<>(new JWKSet(rsaKey));
}

# Resource Server application.yml
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://auth.example.com  # Your authorization server URL

spring:
  security:
    oauth2:
      client:
        registration:
          my-auth-server:
            client-id: web-client
            client-secret: web-secret
            authorization-grant-type: authorization_code
            scope: openid, profile, email
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        provider:
          my-auth-server:
            issuer-uri: https://auth.example.com