How does spring oauth2 clientDetails.getAuthorities() help/work?

samshers 0
Viewed 82

I am going through this api doc (source) of Spring OAuth2 ClientDetails Interface. And I am not sure how this i.e clientDetails.getAuthorities() works or helps in the authorization flow. The API docs describes it as below:

Collection<org.springframework.security.core.GrantedAuthority> getAuthorities()

Returns the authorities that are granted to the OAuth client. Cannot return null. Note that these are NOT the authorities that are granted to the user with an authorized access token. Instead, these authorities are inherent to the client itself.

Returns:
    the authorities (never null)

And I understand the above is different from the userDetails.getAuthorities() of UserDetails Interface. The API docs says as below:

java.util.Collection<? extends GrantedAuthority> getAuthorities()

Returns the authorities granted to the user. Cannot return null.

Returns:
    the authorities, sorted by natural key (never null)

I understand that, in ClientDetails we are dealing with granting permission to the OAuth2 Client, while in UserDetails we are granting the permission to User i.e Principal.

But how is the former different from later and when to use the former.

A little elaboration -
When dealing with OAuth, we are dealing with tokens issued by Auth Server. The tokens are typically jwt tokens with information about the authorities granted to the User. A typical base64 decoded token's payload might look like below:

{
  "app-userId": "c54a-4140-9fa0-0f39",
  "user_name": "abc@xyz.com",
  "scope": [
    "all"
  ],
  "exp": 1656929583,
  "authorities": [
    "app1_viewer",
    "app1_modifier",
    "app2_viewer",
    "app2_blog_creator],
  "client_id": "client_A"
  ...
}

The authorities above are the authorities of the User who is logged-in and using the app.

  1. When the user accesses app1 - it checks the above jwt token to make sure the user has the required permissions/authorities.
  2. If app1 has to call app2, then app1 passes the above jwt which is specific to current user (as Authorization header) to app2. App2 processes this jwt token received in headers and checks if the user has permissions to access/edit the resource. And returns 200 or 403 accordingly.

As you can see, the process is dealing with userDetails.getAuthorities(). So, how and where or in which case does clientDetails.getAuthorities() help. What are the use cases/examples of it. Could some one explain. Thanks for any answers.

spring-oauth2 spring-security-oauth2 oauth-2.0 spring-security
1 Answers

I am not a Java hero, but I work a lot with Azure and Oauth2. Your question got me thinking what that could be. From what I learned is that Authorities decide who gets a valid token and who doesn't (token issuer). From the Microsoft Azure documentation about MSAL I got the following:

Authority

The authority is a URL that indicates a directory that MSAL can request tokens from.

Common authorities are:

A valid use case could be that one wants to build a multi-tenant application. So users from multiple authorities are able to sign-up and sign-in to your application. On basis of the authority you can filter which data a user can see, only data from the users' organization for example. Basically the same idea as how you would use the application roles from userDetails.getAuthorities() to restrict what a user can see or do according to his role within that specific application.

Cloudkollektiv0
Related