Spring. Implementation Oauth.2.0 for REST API

user_10434456 0
Viewed 153

How can I combine basic authorization (login + password) with authorization of other services (google, github, facebook) using Spring Boot and Spring Security? There is a lot of information and I don’t understand how to solve this problem correctly. I would be grateful for the tutorial or link to the material.

spring-boot spring-security spring
1 Answers
  • Spring security is implemented using filter chain and each responsibility is allocated to particular type.
  • For an example, the diagram below shows the components involved in username password authentication.
  • But Spring security framework allows you to have multiple implementations for each type in the same application.
  • If you want multiple authentication mechanisms, you provide list of concrete implementations for each stage for that mechanism. For example, in your case, in the AuthenticationFilter you will have a UsernamePasswordAuthenticationFilter for username/password authentication mechanism and a OAuth2LoginAuthenticationFilter for Oauth2 Login mechanism. And then for AuthenticationTokens, you will have UsernamePasswordAuthenticationToken and OAuth2LoginAuthenticationToken. And so on for each stage.
  • Now When an http request reaches the server, at each stage, spring will iterate through your list for that stage until one of them satisfies or the list is complete. For example, if the request is coming with a password param (or you know it is always come from /login url), at the AuthenticationFilter, OAuth2LoginAuthenticationFilter will satisfy it and it will create the UsernamePasswordAuthenticationToken and pass it to third stage . But if the request comes with token, it will satisfy OAuth2LoginAuthenticationFilter and it will create OAuth2LoginAuthenticationToken and pass it to 3rd stage.

I hope this gives you a high level picture, just implement an sample app with username and password only, put breakpoints in the source code spring security classes I mentioned and see how it is iterating at each stage.

Once you are confident how these filters are chained, then try to add something like ldap authentication as the second authentication mechanism for your app.

Once you are confident implementing these 2, then go for adding OAuth2 by following https://spring.io/guides/tutorials/spring-boot-oauth2/

enter image description here

Reference Diagram: https://springbootdev.com/2017/08/23/spring-security-authentication-architecture/

user_78756230
Related