如何保护具有身份提供者的 Spring Boot 微服务以无状态方式进行身份验证？

Question

How to implement security on spring-boot microservices integrated with angular UI. I have an external identity provider(Ping Federate) to support SSO and all user roles/authorities are maintained in the application database.

What is the best approach to secure APIs? If Oauth is recommended way, how to implement it(Stateless).

Should the Authorization Server be customized to connect to the identity provider Authorization Server and generate tokens from the custom Authorization Server? or would it be better if Oauth2 client generates token by loading user details from the database after successful authentication with the identity provider?

I have tried to implement custom auth server, which internally connects to identity provider auth server taking reference from https://github.com/spring-projects/spring-authorization-server/tree/main/samples/federated-identity-authorizationserver

But it is stateful and I am looking for a stateless approach, also how to customize after successful authentication to load user roles/authorities and generated token from application database

Any code samples along with suggestions will be appreciated.

Thanks in Advance

Answer 1

Why don't you just keep things simple with regular OpenID setup?

• pingfederate: authorization-server responsible for issuing authorization token holding end-user identity and roles
• angular UI: client
• spring Rest service: resource server with security based on end-user identity and roles from the authorization token

You might not need anything more.

Get a look at this tutorial I wrote: https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials/resource-server_with_oauthentication

Adapting it to ping federate should be just a matter of setting a few properties:

• issuer URI
• which private claim to get roles from

(but I haven't tried for ping federated yet).

If you happen to need more than just RBAC in resource server (RoleBasedAccessControl => security decisions based on user authorities), you might have a look at this other tutorial too: https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials/resource-server_with_specialized_oauthentication

Edit: starting form the first tutorial, you could add this:

@EnableGlobalMethodSecurity(prePostEnabled = true)
public static class WebSecurityConfig {
    @Bean
    Jwt2AuthoritiesConverter authoritiesConverter(RolesService rolesService) {
        return jwt -> rolesService.getRolesBySubject(jwt.getSubject()).stream().map(SimpleGrantedAuthority::new).toList();
    }
}

@Service
public class RolesService {

    @Cacheable("user_roles")
    public Set<String> getRolesBySubject(String userSubject) {
        // FIXME: call a JPA repository or remote WebService instead
        return Set.of("MACHIN");
    }
}