Skip to content

Commit 1350053

Browse files
author
Moary Chen
authored
Update AAD client resource server auto-configuration to use Spring Security default beans (Azure#20816)
1 parent cf1bd7b commit 1350053

File tree

6 files changed

+63
-38
lines changed

6 files changed

+63
-38
lines changed

‎sdk/spring/azure-spring-boot-samples/azure-spring-boot-sample-active-directory-resource-server-obo/src/main/java/com/azure/spring/sample/aad/configuration/AADSampleConfiguration.java‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,17 @@
22

33
import org.springframework.context.annotation.Bean;
44
import org.springframework.context.annotation.Configuration;
5-
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
6-
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
5+
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
76
import org.springframework.security.oauth2.client.web.reactive.function.client.ServletOAuth2AuthorizedClientExchangeFilterFunction;
87
import org.springframework.web.reactive.function.client.WebClient;
98

109
@Configuration
1110
public class AADSampleConfiguration {
1211

1312
@Bean
14-
public static WebClient webClient(ClientRegistrationRepository clientRegistrationRepository,
15-
OAuth2AuthorizedClientRepository authorizedClientRepository) {
13+
public static WebClient webClient(OAuth2AuthorizedClientManager oAuth2AuthorizedClientManager) {
1614
ServletOAuth2AuthorizedClientExchangeFilterFunction function =
17-
new ServletOAuth2AuthorizedClientExchangeFilterFunction(clientRegistrationRepository,
18-
authorizedClientRepository);
15+
new ServletOAuth2AuthorizedClientExchangeFilterFunction(oAuth2AuthorizedClientManager);
1916
return WebClient.builder()
2017
.apply(function.oauth2Configuration())
2118
.build();

‎sdk/spring/azure-spring-boot/src/main/java/com/azure/spring/aad/AADIssuerJWSKeySelector.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,7 @@ private JWSKeySelector<SecurityContext> fromIssuer(String issuer) {
6565
try {
6666
JWKSource<SecurityContext> jwkSource = new RemoteJWKSet<>(new URL(uri), jwkSetRetriever);
6767
return JWSAlgorithmFamilyJWSKeySelector.fromJWKSource(jwkSource);
68-
}
69-
catch (Exception ex) {
68+
} catch (Exception ex) {
7069
throw new IllegalArgumentException(ex.getMessage(), ex);
7170
}
7271
}

‎sdk/spring/azure-spring-boot/src/main/java/com/azure/spring/aad/webapi/AADResourceServerClientConfiguration.java‎

Lines changed: 2 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,12 @@
1717
import org.springframework.boot.context.properties.EnableConfigurationProperties;
1818
import org.springframework.context.annotation.Bean;
1919
import org.springframework.context.annotation.Configuration;
20-
import org.springframework.security.oauth2.client.InMemoryOAuth2AuthorizedClientService;
2120
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
2221
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
2322
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
24-
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
2523
import org.springframework.security.oauth2.client.registration.ClientRegistration;
2624
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
2725
import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
28-
import org.springframework.security.oauth2.client.web.AuthenticatedPrincipalOAuth2AuthorizedClientRepository;
2926
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
3027
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
3128
import org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter;
@@ -54,8 +51,8 @@ public class AADResourceServerClientConfiguration {
5451

5552

5653
@Bean
57-
OAuth2AuthorizedClientManager authorizedClientManager(ClientRegistrationRepository clients,
58-
OAuth2AuthorizedClientRepository authorizedClients) {
54+
public OAuth2AuthorizedClientManager authorizeClientManager(ClientRegistrationRepository clients,
55+
OAuth2AuthorizedClientRepository authorizedClients) {
5956

6057
DefaultOAuth2AuthorizedClientManager manager =
6158
new DefaultOAuth2AuthorizedClientManager(clients, authorizedClients);
@@ -83,26 +80,6 @@ public ClientRegistrationRepository clientRegistrationRepository() {
8380
return new InMemoryClientRegistrationRepository(clients);
8481
}
8582

86-
@Bean
87-
@ConditionalOnMissingBean
88-
OAuth2AuthorizedClientService authorizedClientService(ClientRegistrationRepository clientRegistrationRepository) {
89-
return new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
90-
}
91-
92-
/**
93-
* Use InMemoryClientRegistrationRepository and ClientRegistrationRepository to create
94-
* AADResourceServerOAuth2AuthorizedClientRepository
95-
*
96-
* @param oAuth2AuthorizedClientService authorized client repository
97-
* @return AADResourceServerOAuth2AuthorizedClientRepository Bean
98-
*/
99-
@Bean
100-
@ConditionalOnMissingBean
101-
public OAuth2AuthorizedClientRepository oAuth2AuthorizedClientRepository(
102-
OAuth2AuthorizedClientService oAuth2AuthorizedClientService) {
103-
return new AuthenticatedPrincipalOAuth2AuthorizedClientRepository(oAuth2AuthorizedClientService);
104-
}
105-
10683
/**
10784
* Create clients based on configuration items
10885
*

‎sdk/spring/azure-spring-boot/src/test/java/com/azure/spring/aad/webapi/AADOAuth2AuthorizedClientCredentialRepositoryTest.java‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,17 @@
66
import org.junit.jupiter.api.BeforeEach;
77
import org.junit.jupiter.api.Test;
88
import org.springframework.context.annotation.AnnotationConfigApplicationContext;
9+
import org.springframework.context.annotation.Bean;
10+
import org.springframework.context.annotation.Configuration;
911
import org.springframework.security.core.Authentication;
1012
import org.springframework.security.oauth2.client.InMemoryOAuth2AuthorizedClientService;
1113
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
14+
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
1215
import org.springframework.security.oauth2.client.registration.ClientRegistration;
16+
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
1317
import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
18+
import org.springframework.security.oauth2.client.web.AuthenticatedPrincipalOAuth2AuthorizedClientRepository;
19+
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
1420
import org.springframework.security.oauth2.core.AuthorizationGrantType;
1521
import org.springframework.security.oauth2.core.OAuth2AccessToken;
1622
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
@@ -22,6 +28,21 @@
2228

2329
public class AADOAuth2AuthorizedClientCredentialRepositoryTest {
2430

31+
@Configuration
32+
public static class WebOAuth2ClientConfiguration {
33+
34+
@Bean
35+
OAuth2AuthorizedClientService authorizedClientService(ClientRegistrationRepository clientRegistrationRepository) {
36+
return new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
37+
}
38+
39+
@Bean
40+
public OAuth2AuthorizedClientRepository oAuth2AuthorizedClientRepository(
41+
OAuth2AuthorizedClientService oAuth2AuthorizedClientService) {
42+
return new AuthenticatedPrincipalOAuth2AuthorizedClientRepository(oAuth2AuthorizedClientService);
43+
}
44+
}
45+
2546
private static final String AAD_PROPERTY_PREFIX = "azure.activedirectory.";
2647
private static final String CLIENT_CREDENTIAL_ACCESS_TOKEN =
2748
"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Im5PbzNaRHJPRFhFSzFqS1doWHNsSFJfS1hFZyIsImtpZCI6Im5PbzNaRHJPRFhFSz"
@@ -59,7 +80,7 @@ public void setup() {
5980
+ ".com/xxxx-xxxxx-xxxx/.default",
6081
AAD_PROPERTY_PREFIX + "authorization-clients.fake.authorization-grant-type = client_credentials"
6182
);
62-
context.register(AADResourceServerClientConfiguration.class);
83+
context.register(WebOAuth2ClientConfiguration.class, AADResourceServerClientConfiguration.class);
6384
context.refresh();
6485
clientRegistrationsRepo = context.getBean(InMemoryClientRegistrationRepository.class);
6586
fakeClientRegistration = ClientRegistration

‎sdk/spring/azure-spring-boot/src/test/java/com/azure/spring/aad/webapi/AADOAuth2AuthorizedOboClientRepositoryTest.java‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,17 @@
77
import org.junit.jupiter.api.BeforeEach;
88
import org.junit.jupiter.api.Test;
99
import org.springframework.context.annotation.AnnotationConfigApplicationContext;
10+
import org.springframework.context.annotation.Bean;
11+
import org.springframework.context.annotation.Configuration;
1012
import org.springframework.security.core.Authentication;
1113
import org.springframework.security.oauth2.client.InMemoryOAuth2AuthorizedClientService;
1214
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
15+
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
1316
import org.springframework.security.oauth2.client.registration.ClientRegistration;
17+
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
1418
import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
19+
import org.springframework.security.oauth2.client.web.AuthenticatedPrincipalOAuth2AuthorizedClientRepository;
20+
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
1521
import org.springframework.security.oauth2.core.AuthorizationGrantType;
1622
import org.springframework.security.oauth2.core.OAuth2AccessToken;
1723
import org.springframework.security.oauth2.jwt.Jwt;
@@ -22,6 +28,21 @@
2228

2329
public class AADOAuth2AuthorizedOboClientRepositoryTest {
2430

31+
@Configuration
32+
public static class WebOAuth2ClientConfiguration {
33+
34+
@Bean
35+
OAuth2AuthorizedClientService authorizedClientService(ClientRegistrationRepository clientRegistrationRepository) {
36+
return new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
37+
}
38+
39+
@Bean
40+
public OAuth2AuthorizedClientRepository oAuth2AuthorizedClientRepository(
41+
OAuth2AuthorizedClientService oAuth2AuthorizedClientService) {
42+
return new AuthenticatedPrincipalOAuth2AuthorizedClientRepository(oAuth2AuthorizedClientService);
43+
}
44+
}
45+
2546
private static final String OBO_ACCESS_TOKEN_1 =
2647
"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImtnMkxZczJUMENUaklmajRydDZKSXluZW4zOCIsImtpZCI6ImtnMkxZczJUMENUaklmajRydDZKSXluZW4zOCJ9.eyJhdWQiOiJhcGk6Ly9zYW1wbGUtY2xpZW50LWlkIiwiaXNzIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvMWQxYTA2YTktYjIwYS00NTEzLThhNjQtZGFiMDhkMzJjOGI2LyIsImlhdCI6MTYwNzA3NTc1MiwibmJmIjoxNjA3MDc1NzUyLCJleHAiOjE2MDcwNzk2NTIsImFjciI6IjEiLCJhaW8iOiJBVFFBeS84UkFBQUFkSllKZkluaHhoWHBQTStVUVR0TmsrcnJnWG1FQmRpL0JhQWJUOGtQT2t1amJhQ2pBSTNBeUZWcnE0NGZHdHNOIiwiYW1yIjpbInB3ZCJdLCJhcHBpZCI6ImZmMzhjYjg2LTljMzgtNGUyMS1iZTY4LWM1ODFhNTVmYjVjMCIsImFwcGlkYWNyIjoiMSIsImZhbWlseV9uYW1lIjoiY2hlbiIsImdpdmVuX25hbWUiOiJhbXkiLCJpcGFkZHIiOiIxNjcuMjIwLjI1NS42OCIsIm5hbWUiOiJhbXkgY2hlbiIsIm9pZCI6ImFiZDI4ZGUxLTljMzctNDg5ZC04ZWVjLWZlZWVmNGQyNzRhMyIsInJoIjoiMC5BQUFBcVFZYUhRcXlFMFdLWk5xd2pUTEl0b2JMT1A4NG5DRk92bWpGZ2FWZnRjQjRBQUkuIiwic2NwIjoiUmVzb3VyY2VBY2Nlc3NDdXN0b21SZXNvdXJjZXMucmVhZCBSZXNvdXJjZUFjY2Vzc0dyYXBoLnJlYWQgUmVzb3VyY2VBY2Nlc3NPdGhlclJlc291cmNlcy5yZWFkIiwic3ViIjoiS0xyMXZFQTN3Wk1MdWFFZU1IUl80ZmdTdVVVVnNJWDhHREVlOWU5M1BPYyIsInRpZCI6IjFkMWEwNmE5LWIyMGEtNDUxMy04YTY0LWRhYjA4ZDMyYzhiNiIsInVuaXF1ZV9uYW1lIjoiYW15QG1vYXJ5Lm9ubWljcm9zb2Z0LmNvbSIsInVwbiI6ImFteUBtb2FyeS5vbm1pY3Jvc29mdC5jb20iLCJ1dGkiOiJFTG1xXzZVUkJFS19kN3I4ZlFJR0FBIiwidmVyIjoiMS4wIn0.fM_huHrr5M243oM3rMagGGckoxkLanFkurMJz4EBthrdQlFJzl6eo13pmU0Taq2ognAzsxUka0yihImrvhqzub9IGxRtCdQ3NAvD1fAiVdSUt_aBetIFCi5Pdc6I7KJDiGMQh8RTmduM7IOdxV_3-rug6dZXhW5TTmeq5PfLGYlrKOkC2za7M5G7gn7li1D5osh98HorFBWZoCDhe1iJPd_p_m0EffwTbKFwyvOGN-PKxyzOnoCOma_VYvRABUtBa8rNBFTaH5R9EAvsOmIZ_mI98Irl_8QNr9No-R0nXOrqKCFx5sMYkUuT7mvSaVPAlNr2X8eJjY3Wi-6ishufWQ";
2748

@@ -47,7 +68,7 @@ public void setup() {
4768
AAD_PROPERTY_PREFIX + "client-secret = fake-client-secret",
4869
AAD_PROPERTY_PREFIX + "authorization-clients.fake-graph.scopes = https://graph.microsoft.com/.default"
4970
);
50-
context.register(AADResourceServerClientConfiguration.class);
71+
context.register(WebOAuth2ClientConfiguration.class, AADResourceServerClientConfiguration.class);
5172
context.refresh();
5273

5374
clientRegistrationsRepo = context.getBean(InMemoryClientRegistrationRepository.class);

‎sdk/spring/azure-spring-boot/src/test/java/com/azure/spring/aad/webapi/AADResourceServerClientConfigurationTest.java‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,12 @@
55

66
import com.azure.spring.autoconfigure.aad.AADAuthenticationProperties;
77
import org.junit.Test;
8+
import org.springframework.boot.autoconfigure.AutoConfigurations;
9+
import org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration;
810
import org.springframework.boot.test.context.FilteredClassLoader;
911
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
12+
import org.springframework.context.annotation.Import;
13+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
1014
import org.springframework.security.oauth2.client.registration.ClientRegistration;
1115
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
1216
import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
@@ -21,6 +25,12 @@
2125

2226
public class AADResourceServerClientConfigurationTest {
2327

28+
@EnableWebSecurity
29+
@Import(OAuth2ClientAutoConfiguration.class)
30+
public static class WebOAuth2ClientApp {
31+
32+
}
33+
2434
private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner()
2535
.withPropertyValues(
2636
"azure.activedirectory.tenant-id=fake-tenant-id",
@@ -41,7 +51,7 @@ public void testWithoutAnyPropertiesSet() {
4151
@Test
4252
public void testWithRequiredPropertiesSet() {
4353
new WebApplicationContextRunner()
44-
.withUserConfiguration(AADResourceServerClientConfiguration.class)
54+
.withConfiguration(AutoConfigurations.of(WebOAuth2ClientApp.class, AADResourceServerClientConfiguration.class))
4555
.withPropertyValues("azure.activedirectory.client-id=fake-client-id")
4656
.run(context -> {
4757
assertThat(context).hasSingleBean(AADAuthenticationProperties.class);
@@ -69,7 +79,7 @@ public void testNotExistOAuth2LoginAuthenticationFilter() {
6979
@Test
7080
public void testOnlyGraphClient() {
7181
this.contextRunner
72-
.withUserConfiguration(AADResourceServerClientConfiguration.class)
82+
.withConfiguration(AutoConfigurations.of(WebOAuth2ClientApp.class, AADResourceServerClientConfiguration.class))
7383
.withPropertyValues("azure.activedirectory.authorization-clients.graph.scopes="
7484
+ "https://graph.microsoft.com/User.Read")
7585
.run(context -> {
@@ -114,7 +124,7 @@ public void clientWhichGrantTypeIsOboButOnDemandExceptionTest() {
114124
@Test
115125
public void testExistCustomAndGraphClient() {
116126
this.contextRunner
117-
.withUserConfiguration(AADResourceServerClientConfiguration.class)
127+
.withConfiguration(AutoConfigurations.of(WebOAuth2ClientApp.class, AADResourceServerClientConfiguration.class))
118128
.withPropertyValues("azure.activedirectory.authorization-clients.graph.scopes="
119129
+ "https://graph.microsoft.com/User.Read")
120130
.withPropertyValues("azure.activedirectory.authorization-clients.custom.scopes="

0 commit comments

Comments
 (0)