3

I'm currently setting up a single resource server that will be validating access tokens from various authorization servers.

Spring security (using the Okta security starter with this as well) seems to only allow me to set a single issuer URI.

I managed to find a solution that works but I'm unsure if this is the best practice/standard way of doing it. In the code snippet below I've explicitly setup the resources with Spring's Java Config for simplicity.

@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
  http
      .authorizeExchange()
      .pathMatchers("/api/protected/by/authserver1")
      .and()
      .oauth2ResourceServer()
      .jwt()
          .jwtDecoder(ReactiveJwtDecoders.fromOidcIssuerLocation("https://authserver1")
      .and()
      .and()
      .authorizeExchange()
      .pathMatchers("/api/protected/by/authserver2")
      .and()
      .oauth2ResourceServer()
      .jwt()
          .jwtDecoder(ReactiveJwtDecoders.fromOidcIssuerLocation("https://authserver2");

  return http.build()
}

This seems to work exactly as intended, tokens minted from one auth server and used on the endpoint validating the other receive 401. When the minted tokens are used on their respective endpoint, they are successfully validated.

It looks a little funny having .and() calls back to back, I'm under the impression that these chained calls are just creating multiple web filters under the hood? Either way, is this the standard way of enabling this functionality in a Spring application with Spring Security and WebFlux?

Additionally, I came across this SO question but I don't know that I'll be able to setup a 'federation provider' within the context of this project. However, If that approach is the best practice I'd like to know. However, I think that's happening to some extent at the Okta level with the federation broker mode on the auth server access policies...?

Jon Catanio
  • 283
  • 1
  • 3
  • 11

1 Answers1

0

Either way, is this the standard way of enabling this functionality in a Spring application with Spring Security and WebFlux?

No. What's more the example you've provided won't work. You can investigate the ServerHttpSecurity implementation and see why. Actually when you call oauth2ResourceServer() it sets new OAuth2ResourceServerSpec or returns the old one which can be modified. So in your case only the second JwtDecoder will be applied, because it overrides the first one. If you want to configure oauth2ResourceServer per path you'll have to define multiple SecurityWebFilterChain as posted here https://stackoverflow.com/a/54792674/1646298 .

ZZ 5
  • 1,744
  • 26
  • 41