spring OAuth server 구성

Oauth2.0 인증방식

인증방식	용도	비고
Authorization Code	웹 서버 상에서 동작하는 애플리케이션	가장 많이 사용되는 유형
Implicit	모바일 앱 또는 단말기에서 동작하는 웹 애플리케이션
Resource Owner Password	단말기 OS 또는 높은 신뢰 관계의 애플리케이션	다른 유형들을 사용할 수 없을 경우에만 사용
Client Credentials	애플리케이션 API 접근	신뢰하는 클라이언트만 사용

client credentials api flow 

Open API 서비스는 신뢰하는 클라이언트들 에게 API 서비스를 제공하기 위한 목적으로 사용되기 때문에

Oauth2.0 방식에서 Client Credentials 인증방식을 사용하는게 좋을거라고 판단했습니다.

OAuth2.0 Server endpoint 명세

1.

/oauth/token

POST

header - authorization : Basic Base64Encoder( " client_id : client_secret " )

: 해당하는 토큰을 연결된 DB에 저장한다. 

2. 

/oauth/check_token

GET

?token=1234asd-1234a-qweqwe....

header - authorization : Basic Base64Encoder( " client_id : client_secret " )

OAuth2.0 Server 세팅

gradle 설정

implementation('org.springframework.boot:spring-boot-starter-web')
//세팅을 db로 해야할 시에 필요합니다.
implementation('org.springframework.boot:spring-boot-starter-data-jpa')
implementation('mysql:mysql-connector-java')

//spring security
implementation('org.springframework.boot:spring-boot-starter-security')
implementation('org.springframework.cloud:spring-cloud-starter-oauth2')


application.yml 설정

security:
  oauth2:
    authorization:
      check-token-access: isAuthenticated()

spring:
  datasource:
    driver-class-name: com.mysql.jdbc.Driver
    url: jdbc:mysql:( db url )
    username: ( db username )
    password: ( db password )

Config 설정

OauthApplication.class

@EnableResourceServer
@EnableAuthorizationServer
@SpringBootApplication
public class OauthApplication {

    public static void main(String[] args) {
        SpringApplication.run(OauthApplication.class, args);
    }

}

Oauth2Configuration.class

@Configuration
public class Oauth2Configuration {

    /**
     * 토큰을 저장할 db접속정보 지정
     * @param dataSource
     * @return
     */
    @Bean
    public TokenStore jdbcTokenStore(DataSource dataSource) {
        return new JdbcTokenStore(dataSource);
    }


    /**
     *
     * client_id 와 client_secret을 비교하기 위해 사용할 db접속정보를 등록한다.
     * @param dataSource
     * @return
     */
    @Bean
    @Primary
    public JdbcClientDetailsService jdbcClientDetailsService(DataSource dataSource) {
        return new JdbcClientDetailsService(dataSource);
    }

}

Oauth2AuthorizationServerConfiguration.class

@Configuration
public class Oauth2AuthorizationServerConfiguration extends OAuth2AuthorizationServerConfiguration {

    @Autowired
    private ClientDetailsService clientDetailsService;

    public Oauth2AuthorizationServerConfiguration(BaseClientDetails details,
            AuthenticationConfiguration authenticationConfiguration,
            ObjectProvider<TokenStore> tokenStore,
            ObjectProvider<AccessTokenConverter> tokenConverter,
            AuthorizationServerProperties properties) throws Exception {
        super(details, authenticationConfiguration, tokenStore, tokenConverter, properties);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.withClientDetails(clientDetailsService);
    }

}

OAuth2.0 Server table 세팅

client id / client secret / token 을 모두 table에 저장하고 관리하게 설정했으므로

실제로 database에 테이블이 필요하다.

client id / client secret 을 담고있는 table

oauth_client_detail  

create table oauth_client_details

                (

                client_id varchar(256) null,

                resource_ids varchar(256) null,

                client_secret varchar(256) null,

                scope varchar(256) null,

                authorized_grant_types varchar(256) null,

                web_server_redirect_uri varchar(256) null,

                authorities varchar(256) null,

                access_token_validity integer null,

                refresh_token_validity integer null,

                additional_information varchar(4096) null,

                autoapprove varchar(256) null,

                id varchar(20) null,

                constraint oauth_client_details_pk

                primary key (id)

                )

token 을 담고있는 table

oauth_access_token

create table oauth_access_token

                (

                token_id varchar(256) null,

                authentication_id varchar(128) null,

                user_name varchar(256) null,

                client_id varchar(256) null,

                refresh_token varchar(256) null,

                token blob null,

                authentication blob null,

                constraint oauth_access_token_pk

                primary key (authentication_id)

                )

OAuth2.0 TestCode

@RunWith(SpringRunner.class)
@WebAppConfiguration
@SpringBootTest(classes = OauthApplication.class)
public class Oauth2ResourceServerTest {

    private MockMvc mockMvc;

    @Autowired
    private WebApplicationContext webApplicationContext;

    @Autowired
    private FilterChainProxy springSecurityFilterChain;

    @Before
    public void setUp() {
        mockMvc = MockMvcBuilders.webAppContextSetup(this.webApplicationContext).addFilter(springSecurityFilterChain).build();
    }

    @Test
    public void 액세스토큰_발급받기_만약_키와_비밀코드가_맞을때_테스트() throws Exception {

        MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
        params.add("grant_type", "client_credentials");

        ResultActions result
                = mockMvc.perform(post("/oauth/token")
                .params(params)
                .with(httpBasic("open_api_key2","waug_secret2"))
                .accept("application/json;charset=UTF-8"))
                .andExpect(status().isOk())
                .andExpect(content().contentType("application/json;charset=UTF-8"));

        String resultString = result.andReturn().getResponse().getContentAsString();

        JacksonJsonParser jsonParser = new JacksonJsonParser();
        String resultToken = jsonParser.parseMap(resultString).get("access_token").toString();

        System.out.println(resultToken);
    }

    @Test
    public void 액세스토큰_발급받기_만약_키와_비밀코드가_맞지않을때_테스트() throws Exception {

        MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
        params.add("grant_type", "client_credentials");

        ResultActions result
                = mockMvc.perform(post("/oauth/token")
                .params(params)
                .with(httpBasic("open_api_key_not","waug_secret_not"))
                .accept("application/json;charset=UTF-8"))
                .andExpect(status().isUnauthorized());
    }

}