如何在Spring中使用OAuth2和JWT令牌代表特定用户调用受保护的资源？

Question

So we have an authentication server where the UI application gets the access token and then it communicate with API server, it's all good. Now we are building a third application which needs SSO to authenticate the same user and that is fine too.

However, there are scenarios where this third application needs to use some resources on the API server which, from my understanding, we need to get a token from auth server using client-id/secret and then send the request with the access token. This seems ok too, however I am not sure how API server is going to authorise that token ( a hint on this would be great ).

But the main problem is we want this request to be sent on behalf of the user. This is because API server needs to audit all user's activities. How can we achieve this using Spring Boot/OAuth2 and JWT Token?

I went through documentation and I know about @EnableOauth2Sso @EnableAuthorisationServer etc. but this scenario is not clear and I'm not even sure it's been implemented in Spring or not.

If there is no implementation for this scenario, what do you recommend? Any experience you have had on this, can you please share?

Answer 1

Your API server plays the role of a Resource Server. There is an annotation designed for that purpose: @EnableResourceServer . Your client app then will consume this resource using the handy OAuth2RestTemplate .

There are two approaches to properly configure the Resource Server and get this working:

1. Have the public key directly in your resource server app: this way when the client app try to use a token provided by the authorization server to get a resource from the Resource Server, this will verify if the token is valid by itself.
2. Configure the resource server to ask the authorization server if a given access token is valid and depending of the response it will allow or decline to get the resource.

I have posted a sample app on github using the first approach. There you can see the interaction between the Authorization Server, the Client and the Resource Server, as well as all the configurations you need for this implementation. Hope it helps you.