is it possible to use TokenStorage with spring-security-oauth2-authorization-server? or should I add an extra library to my pom.xml? I want to register the token in redis so that it is possible to kick a user manually without waiting for the session to time out.
when I use these dependencies I can't import TokenStorage:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-authorization-server</artifactId>
<version>0.3.1</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
This is my Authorization configuration:
@Configuration
@AllArgsConstructor
public class AuthorizationServerConfig {
private final CORSCustomizer corsCustomizer;
@Bean
@Order(Ordered.HIGHEST_PRECEDENCE)
public SecurityFilterChain securityASFilterChain(HttpSecurity http) throws Exception {
OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
corsCustomizer.corsCustomizer(http);
return http.formLogin().and().build();
}
@Bean
public RegisteredClientRepository registredClientRepository() {
var rc = RegisteredClient.withId(UUID.randomUUID().toString())
.clientId("client")
.clientSecret("secret")
.scope(OidcScopes.OPENID)
.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
.redirectUri("http://127.0.0.1:9081/authorized")
.tokenSettings(TokenSettings.builder()
.accessTokenTimeToLive(Duration.ofHours(10))
.refreshTokenTimeToLive(Duration.ofHours(10))
.build())
.clientSettings(ClientSettings.builder()
.requireAuthorizationConsent(true)
.build())
.build();
return new InMemoryRegisteredClientRepository(rc);
}
@Bean
public ProviderSettings providerSettings() {
return ProviderSettings.builder()
.issuer("http://localhost:9090/oauth2/issuer")
.build();
}
@Bean
public JWKSource<SecurityContext> jwkSource(){
RSAKey rsaKey = JwksKeys.generateRSAKey();
JWKSet set = new JWKSet(rsaKey);
return (j,sc) -> j.select(set);
}
@Bean
public TokenStore tokenStore(RedisConnectionFactory redisConnectionFactory) {
return new RedisTokenStore(redisConnectionFactory);
}
}
I have seen on the internet that some use spring-security-oauth2-autoconfigure and others use spring-cloud-starter-oauth2 instead of spring-security-oauth2-authorization-server, what is the difference? or which one is better?