Support AuthoritiesProvider for Resource Server flows (opaque and jwt)

[bdemers]

Currently, the AuthoritiesProvider interface only supports authorization code flow and not resource servers.

We should be able to add a new method or two in AuthoritiesProvider to support resource servers.

[bdemers]

NOTE: As part of this change it should be possible, to lookup and use the JwtAuthenticationConverter bean instead of explicitly setting the OktaJwtAuthenticationConverter

[paulorego]

Hi, is there any way to add custom authorities on resource servers using JWT and OKTA?

[bdemers]

@paulorego Currently you would need to do something like this:

https://github.com/okta/okta-spring-boot/blob/master/oauth2/src/main/java/com/okta/spring/boot/oauth/OktaOAuth2ResourceServerAutoConfig.java#L63-L68

However, some of those classes are package protected, so they would need to be wrapped (with something like a BeanPostProcessor 😢), or re-implemented.

[swargolet]

@bdemers How would this bean get picked up? Looking at OktaOAuth2Configurer (https://github.com/okta/okta-spring-boot/blob/master/oauth2/src/main/java/com/okta/spring/boot/oauth/OktaOAuth2Configurer.java#L155-L156), it doesn't use the JwtAuthenticationConverter bean but instantiates a new one.

Is there something I'm missing here? We are also trying to add our own authorities but haven't been able to.

[bdemers]

@swargolet good catch, I guess I was typing faster than thinking 😄

I started writing a reply, but then figured it would be easier to try to hack something up, I was wrong...
But it was still useful to figure out what it will take to add this feature: #405

TL;DR: it's still going to take a bit of work 😞

[swargolet]

Ended up coming up with a solution around this.
Since the OktaOAuth2Configurer overrides everything after .oauth2ResourceServer() in the security config, we can look one level ahead of that. In this case we can leverage overriding the authProvider and providing our own implementation which has our own converter implementation. See below for the security config.

Only downside to this, which I call out in a comment is that it overrides the OktaJwtAuthenticationConverter and thus the logic in which it pulls the claims in from the token is not utilized.

@Configuration
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private JwtDecoder jwtDecoder;
    private Converter<Jwt, Collection<GrantedAuthority>> myJWTGrantedAuthoritiesConverter;

    @Autowired
    public void setJwtDecoder(JwtDecoder jwtDecoder) {
        this.jwtDecoder = jwtDecoder;
    }

    @Autowired
    public void setMyJWTGrantedAuthoritiesConverter(Converter<Jwt, Collection<GrantedAuthority>> myJWTGrantedAuthoritiesConverter) {
        this.myJWTGrantedAuthoritiesConverter = myJWTGrantedAuthoritiesConverter;
    }

    private Converter<Jwt, AbstractAuthenticationToken> jwtAuthenticationConverter() {
        JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(myJWTGrantedAuthoritiesConverter);
        return jwtAuthenticationConverter;
    }

    private AuthenticationProvider authProvider() {
        JwtAuthenticationProvider jwtAuthenticationProvider = new JwtAuthenticationProvider(jwtDecoder);
        Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter = jwtAuthenticationConverter();
        jwtAuthenticationProvider.setJwtAuthenticationConverter(jwtAuthenticationConverter);
        return jwtAuthenticationProvider;
    }

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeRequests()
            .anyRequest()
                .authenticated()
            .and()
                .authenticationProvider(authProvider()) // This overrides OktaJwtAuthenticationConverter and this we lose claims to Authorities functionality
                .oauth2ResourceServer()
                    .jwt()
        ;
    }
}

[bdemers]

Thanks for following up!

[Sam-Bate-ITV]

why is this closed as completed if the related PR was not merged and the problem remains in the latest release? Please can this be reopened.