is it possible to use TokenStorage with spring-security-oauth2-authorization-server?

Viewed 27

is it possible to use TokenStorage with spring-security-oauth2-authorization-server? or should I add an extra library to my pom.xml? I want to register the token in redis so that it is possible to kick a user manually without waiting for the session to time out.

when I use these dependencies I can't import TokenStorage:

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-oauth2-authorization-server</artifactId>
        <version>0.3.1</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-redis</artifactId>
    </dependency>

This is my Authorization configuration:

@Configuration
@AllArgsConstructor
public class AuthorizationServerConfig {

 private final CORSCustomizer corsCustomizer;

 @Bean
 @Order(Ordered.HIGHEST_PRECEDENCE)
 public SecurityFilterChain securityASFilterChain(HttpSecurity http) throws Exception {
    OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
    corsCustomizer.corsCustomizer(http);
    return http.formLogin().and().build();
 }

 @Bean
 public RegisteredClientRepository registredClientRepository() {
    var rc = RegisteredClient.withId(UUID.randomUUID().toString())
            .clientId("client")
            .clientSecret("secret")
            .scope(OidcScopes.OPENID)
            .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
            .redirectUri("http://127.0.0.1:9081/authorized")
            .tokenSettings(TokenSettings.builder()
                    .accessTokenTimeToLive(Duration.ofHours(10))
                    .refreshTokenTimeToLive(Duration.ofHours(10))
                    .build())
            .clientSettings(ClientSettings.builder()
                    .requireAuthorizationConsent(true)
                    .build())
            .build();
    return new InMemoryRegisteredClientRepository(rc);
 }

 @Bean
 public ProviderSettings providerSettings() {
    return ProviderSettings.builder()
            .issuer("http://localhost:9090/oauth2/issuer")
            .build();
 }

 @Bean
 public JWKSource<SecurityContext> jwkSource(){
    RSAKey rsaKey = JwksKeys.generateRSAKey();
    JWKSet set = new JWKSet(rsaKey);
    return (j,sc) -> j.select(set);
 }

 @Bean
 public TokenStore tokenStore(RedisConnectionFactory redisConnectionFactory) {
    return new RedisTokenStore(redisConnectionFactory);
 }
}

I have seen on the internet that some use spring-security-oauth2-autoconfigure and others use spring-cloud-starter-oauth2 instead of spring-security-oauth2-authorization-server, what is the difference? or which one is better?

0 Answers
Related