Project Name | Stars | Downloads | Repos Using This | Packages Using This | Most Recent Commit | Total Releases | Latest Release | Open Issues | License | Language |
---|---|---|---|---|---|---|---|---|---|---|
Pig | 4,728 | 6 days ago | 272 | apache-2.0 | Java | |||||
↥ ↥ ↥ 点击关注更新,基于 Spring Cloud 2021 、Spring Boot 2.7、 OAuth2 的 RBAC 权限管理系统 | ||||||||||
Springdoc Openapi | 2,622 | 5 | 29 | 10 hours ago | 139 | August 21, 2022 | 31 | apache-2.0 | Java | |
Library for OpenAPI 3 with spring-boot | ||||||||||
Pac4j | 2,267 | 146 | 129 | 3 days ago | 96 | September 08, 2022 | apache-2.0 | Java | ||
Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT... | ||||||||||
Liugh Parent | 2,252 | 7 months ago | 15 | Java | ||||||
SpringBoot+SpringCloud Oauth2+JWT+MybatisPlus实现Restful快速开发后端脚手架 | ||||||||||
Spring Boot Quick | 2,152 | 3 months ago | 12 | Java | ||||||
:herb: 基于springboot的快速学习示例,整合自己遇到的开源框架,如:rabbitmq(延迟队列)、Kafka、jpa、redies、oauth2、swagger、jsp、docker、k3s、k3d、k8s、mybatis加解密插件、异常处理、日志输出、多模块开发、多环境打包、缓存cache、爬虫、jwt、GraphQL、dubbo、zookeeper和Async等等:pushpin: | ||||||||||
Javasourcecodelearning | 2,092 | a year ago | 1 | Java | ||||||
Java流行框架源码分析:Spring源码、SpringBoot源码、SpringAOP源码、SpringSecurity源码、SpringSecurity OAuth2源码、JDK源码、Netty源码 | ||||||||||
Community | 2,082 | a year ago | 16 | mit | Java | |||||
开源论坛、问答系统,现有功能提问、回复、通知、最新、最热、消除零回复功能。功能持续更新中…… 技术栈 Spring、Spring Boot、MyBatis、MySQL/H2、Bootstrap | ||||||||||
Spring Boot Cloud | 1,944 | 4 years ago | 22 | Java | ||||||
基于 Spring Boot、Spring Cloud、Spring Oauth2 和 Spring Cloud Netflix 等框架构建的微服务项目 | ||||||||||
Spring Security Oauth | 1,888 | a month ago | 3 | mit | Java | |||||
Just Announced - "Learn Spring Security OAuth": | ||||||||||
Spring Boot Microservices | 1,544 | 4 years ago | 12 | apache-2.0 | Java | |||||
Spring Boot Template for Micro services Architecture - Show cases how to use Zuul for API Gateway, Spring OAuth 2.0 as Auth Server, Multiple Resource (Web Services) Servers, Angular Web App, Eureka dor registration and Discover and Hystrix for circuit breaker |
Okta's Spring Boot Starter will enable your Spring Boot application to work with Okta via OAuth 2.0/OIDC.
This library uses semantic versioning and follows Okta's library version policy.
✔️ The current stable major version series is: 3.x
Version | Status |
---|---|
0.x.x, 1.x.x | ⚠️ Retired |
2.x.x | ✔️ Stable |
3.x.x | ✔️ Stable |
Note: 3.x.x versions of the SDK would need JDK 17 or above.
Okta Spring Boot SDK Versions | Compatible Spring Boot Versions |
---|---|
1.2.x | 2.1.x |
1.4.x | 2.2.x |
1.5.x | 2.4.x |
2.0.x | 2.4.x |
2.1.x | 2.7.x |
3.x.x | 3.0.x |
The latest release can always be found on the releases page.
Create a Spring Boot application with Spring initializr:
curl https://start.spring.io/starter.tgz -d dependencies=web,okta -d baseDir=<<yourProjectName>> | tar -xzvf -
cd <<yourProjectName>>
Configure it with Okta CLI:
okta apps create
Run it:
./mvnw spring-boot:run
For Apache Maven:
<dependency>
<groupId>com.okta.spring</groupId>
<artifactId>okta-spring-boot-starter</artifactId>
<version>${okta.springboot.version}</version>
</dependency>
For Gradle:
compile 'com.okta.spring:okta-spring-boot-starter:${okta.springboot.version}'
where ${okta.springboot.version} is the latest published version in Maven Central.
Are you building backend endpoints in order to support a client side application? If so follow along, otherwise skip to the next section.
You can configure your applications properties with environment variables, system properties, or configuration files. Take a look at the Spring Boot documentation for more details.
Only these three properties are required for a web app:
Property | Default | Required | Details |
---|---|---|---|
okta.oauth2.issuer | N/A | ✅ | Authorization Server issuer URL, i.e.: https://{yourOktaDomain}/oauth2/default |
okta.oauth2.clientId | N/A | * |
The Client Id of your Okta OIDC application |
okta.oauth2.clientSecret | N/A | * |
The Client Secret of your Okta OIDC application |
okta.oauth2.audience | api://default |
The audience of your Authorization Server | |
okta.oauth2.groupsClaim | groups |
The claim key in the Access Token's JWT that corresponds to an array of the users groups. |
*
Required when using opaque access tokens.
The above client makes a request to /hello-oauth
, you simply need to create a Spring Boot application and Controller
to handle the response:
@SpringBootApplication
@RestController
public class DemoApplication {
public static void main(String[] args) {
SpringApplication.run(DemoApplication.class, args);
}
@GetMapping("/hello-oauth")
public String hello(Principal principal) {
return "Hello, " + principal.getName();
}
}
To test things out you can use curl:
$ curl http://localhost:8080/hello-oauth \
--header "Authorization: Bearer ${accessToken}"
The result should look something like:
Hello, [email protected]
Okta's Spring Security integration will parse the JWT access token from the HTTP request's Authorization: Bearer
header value.
Check out a minimal example that uses the Okta Signin Widget and JQuery or this blog post.
Setup your MVC project by following Quickstart section above.
Configure the URL mappings for handling GET
and POST
requests.
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;
@SpringBootApplication
@RestController
public class DemoApplication {
public static void main(String[] args) {
SpringApplication.run(DemoApplication.class, args);
}
@GetMapping("/")
public String index(@AuthenticationPrincipal Jwt jwt) {
return String.format("Hello, %s!", jwt.getSubject());
}
@GetMapping("/message")
@PreAuthorize("hasAuthority('SCOPE_message:read')")
public String message() {
return "secret message";
}
@PostMapping("/message")
@PreAuthorize("hasAuthority('SCOPE_message:write')")
public String createMessage(@RequestBody String message) {
return String.format("Message was created. Content: %s", message);
}
}
NOTE: message:read
and message:write
used above in @PreAuthorize
are OAuth scopes. If you are looking
to add custom scopes, refer to the documentation.
SecurityFilterChain
bean. If neither JWT nor Opaque Token is specified in configuration, JWT validation will be used by default.import com.okta.spring.boot.oauth.Okta;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
@EnableWebSecurity
public class OAuth2ResourceServerSecurityConfiguration {
@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeRequests()
// allow anonymous access to the root page
.antMatchers("/").permitAll()
// all other requests
.anyRequest().authenticated()
.and()
.oauth2ResourceServer().jwt(); // replace .jwt() with .opaqueToken() for Opaque Token case
// Send a 401 message to the browser (w/o this, you'll see a blank page)
Okta.configureResourceServer401ResponseBody(http);
return http.build();
}
}
Refer Spring Security documentation here for more details on resource server configuration.
To configure a resource server when using Spring WebFlux, you need to use a couple annotations, and define a SecurityWebFilterChain
bean.
import com.okta.spring.boot.oauth.Okta;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.method.configuration.EnableReactiveMethodSecurity;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class SecurityConfiguration {
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http
.authorizeExchange()
.anyExchange().authenticated()
.and()
.oauth2ResourceServer()
.jwt();
// Send a 401 message to the browser (w/o this, you'll see a blank page)
Okta.configureResourceServer401ResponseBody(http);
return http.build();
}
}
If you want to support SSO and a resource server in the same application, you can do that too!
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class SecurityConfiguration {
@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
http
.authorizeExchange()
.anyExchange().authenticated()
.and()
.oauth2Login()
.and()
.oauth2ResourceServer()
.jwt();
return http.build();
}
}
Full Stack Reactive with Spring WebFlux, WebSockets, and React uses both SSO and a resource server. Its current code uses Spring Security's OIDC support. Changing it to use the Okta Spring Starter reduces the lines of code quite a bit.
Building a server side application and just need to redirect to a login page? This OAuth 2.0 code flow is for you.
To create a new OIDC app for Spring Boot on Okta:
http://localhost:8080/login/oauth2/code/okta
as a login redirect URI.You can configure your applications properties with environment variables, system properties, or configuration files. Take a look at the Spring Boot documentation for more details.
Property | Required | Details |
---|---|---|
okta.oauth2.issuer | true | Authorization Server issuer URL, i.e.: https://{yourOktaDomain}/oauth2/default |
okta.oauth2.clientId | true | The Client Id of your Okta OIDC application |
okta.oauth2.clientSecret | true | The Client Secret of your Okta OIDC application |
okta.oauth2.postLogoutRedirectUri | false | Set to a relative or absolute URI to enable RP-Initiated (SSO) logout. |
NOTE: On setting postLogoutRedirectUri, you will be redirected to it after the end of your session. Therefore, this resource must be available anonymously, so be sure to add it to your HttpSecurity
configuration.
postLogoutRedirectUri
example:okta:
oauth2:
postLogoutRedirectUri: "http://localhost:8080/logout/callback"
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
public class SecurityConfig {
@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeRequests()
// allow anonymous access to the root and logout pages
.antMatchers("/", "/logout/callback").permitAll()
// all other requests
.anyRequest().authenticated();
return http.build();
}
}
Create a minimal Spring Boot application:
@RestController
@SpringBootApplication
public class ExampleApplication {
public static void main(String[] args) {
SpringApplication.run(ExampleApplication.class, args);
}
@GetMapping("/")
public String getMessageOfTheDay(@AuthenticationPrincipal OidcUser user) {
return user.getName() + ", this message of the day is boring";
}
}
If you want to allow anonymous access to specific routes you can add a SecurityFilterChain
bean:
@Configuration
static class SecurityConfig {
@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/my-anon-page").permitAll()
.anyRequest().authenticated()
.and().oauth2Client()
.and().oauth2Login();
return http.build();
}
}
If you want to add custom claims to JWT tokens in your custom Authorization Server, see Add Custom claim to a token for more info.
You could then extract the attributes from the token by doing something like below:
@RestController
public class ExampleController {
@GetMapping("/email")
public String getUserEmail(AbstractOAuth2TokenAuthenticationToken authentication) {
// AbstractOAuth2TokenAuthenticationToken works for both JWT and opaque access tokens
return (String) authentication.getTokenAttributes().get("sub");
}
}
The Authorization Code Flow (the typical OAuth redirect) uses sessions. If you have multiple instances of your application, you must configure a Spring Session implementation such as Redis, Hazelcast, JDBC, etc.
Open up http://localhost:8080 in your favorite browser.
You'll be redirected automatically to an Okta login page. Once you successfully login, you will be redirected back to your app and you'll see the message of the day!
This module integrates with Spring Security's OAuth support, all you need is the mark your application with the standard @EnableOAuth2Client
annotation.
You can use this starter with Spring Native. However, you will need to enable HTTPS in your main Spring Boot application class. For example:
package com.example.demo;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.nativex.hint.NativeHint;
@NativeHint(options = "--enable-https")
@SpringBootApplication
public class DemoApplication {
public static void main(String[] args) {
SpringApplication.run(DemoApplication.class, args);
}
}
You can also configure this setting in your pom.xml
or build.gradle
. See Spring Native's documentation for more information.
If you're running your application (with this okta-spring-boot dependency) from behind a network proxy, you could setup properties for it in application.yml:
okta:
oauth2:
proxy:
host: "proxy.example.com"
port: 7000
username: "your-username" # optional
password: "your-secret-password" # optional
or, add JVM args to your application like:
-Dokta.oauth2.proxy.host=proxy.example.com
-Dokta.oauth2.proxy.port=port
-Dokta.oauth2.proxy.username=your-username
-Dokta.oauth2.proxy.password=your-secret-password
or, you could set it programmatically like:
System.setProperty("okta.oauth2.proxy.host", "proxy.example.com");
System.setProperty("okta.oauth2.proxy.port", "7000");
System.setProperty("okta.oauth2.proxy.username", "your-username");
System.setProperty("okta.oauth2.proxy.password", "your-secret-password");
See here for the complete list of properties.
Note: Spring WebFlux (and WebClient
) does not support these properties. (See spring-projects/spring-security#8882).
If you are running your Spring Boot App behind a reverse proxy, be sure to read this guide.
To integrate the Okta Java SDK into your Spring Boot application you just need to add a dependency:
<dependency>
<groupId>com.okta.spring</groupId>
<artifactId>okta-spring-sdk</artifactId>
</dependency>
Then define the okta.client.token
property. See creating an API token for more info.
All that is left is to inject the client (com.okta.sdk.client.Client
)! Take a look at this post for more info on the best way to inject your beans.
Want to build this project?
Just clone it and run:
$ git clone https://github.com/okta/okta-spring-boot.git
$ cd okta-spring-boot
$ mvn install