mzlnk/multi-tenant-oauth2-resource-server-spring-boot-starter

Spring Boot starter for multi-tenant OAuth2 resource server

Hey, I'm Marcin Zielonka 👋

Creative and dynamic software engineer with two years of experience in developing large-scale and highly-available JVM-based applications. Always focused on providing clean code and developing both efficient and scalable architecture. Currently refining skills in areas of AuthN/AuthZ, microservice and RESTful architecture, Domain Driven Development.

Currently, I am working as a Software Engineer in Akamai Technologies. I am also a BEng graduate at Computer Science at the Faculty of Computer Science, Electronics and Telecommunications at AGH UST.

Apart from work and studies, I have been also involved in BIT Scientific Research Group where I was a President of whole organisation and former head of BIT Java where I was giving lectures for students about everything connected with Java - the basics of programming, good coding practises, libraries and frameworks (especially Spring Boot).

What I'm focusing on 🔥

Continuously improving Java skills related to Spring Framework and AuthN/AuthZ. Also amazingly fascinated with microservices architecture, its good practices, and recent trends. Trying to do my best by creating web applications using ReactJS or Angular 10+, too 😉

My tech stack:

Trying to be master in topics:

• OAuth2 + OIDC
• AuthN, AuthZ, identity brokering
• Microservice architecture + Domain Driven Development
• REST API design

Some stats 📊

Open-source! 🥳

Fluqxverse

Currently, I am mainly focusing on the project Fluqxverse where I am building consistent and reliable microservice architecture based on JVM using the latest technologies and approaches (some tutorials in the form of articles on Medium are on their way, too 😉).

Libraries and Spring Boot starters

As an enthusiastic Java and Spring Boot Developer I'm creating some tutorials and starters which are open to use!

• OAuth2 Exchange
• Multi Tenancy OAuth Resource Server Spring Boot Starter (Archived)
• Java From Zero To Hero (Archived)

Reach me out! 🔭

multi-tenant-oauth2-resource-server-spring-boot-starter's Issues

Error if not JWT tenant is present

If in the application.properties you don't define almost one JWT resource server the application doesn't start and this is the error:

023-03-29 11:09:40,093 ERROR [org.springframework.boot.SpringApplication] [main] SpringApplication: Application run failed org.springframework.context.ApplicationContextException: Unable to start web server; nested exception is org.springframework.boot.web.server.WebServerException: Unable to start embedded Tomcat at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:162) at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:577) at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:144) at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:771) at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:763) at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:438) at org.springframework.boot.SpringApplication.run(SpringApplication.java:339) at org.springframework.boot.SpringApplication.run(SpringApplication.java:1329) at org.springframework.boot.SpringApplication.run(SpringApplication.java:1318) at es.ibermutua.prestaciones.rel.composite.RelCompositeApp.main(RelCompositeApp.java:25) Caused by: org.springframework.boot.web.server.WebServerException: Unable to start embedded Tomcat at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.initialize(TomcatWebServer.java:142) at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.<init>(TomcatWebServer.java:104) at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.getTomcatWebServer(TomcatServletWebServerFactory.java:450) at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.getWebServer(TomcatServletWebServerFactory.java:199) at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.createWebServer(ServletWebServerApplicationContext.java:181) at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:159) ... 9 common frames omitted Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'authenticationTenantContextFilter' defined in class path resource [io/mzlnk/springframework/multitenant/oauth2/resourceserver/AutoConfiguration.class]: Unsatisfied dependency expressed through method 'authenticationTenantContextFilter' parameter 0; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'multitenantAuthenticationManagerResolver' defined in class path resource [io/mzlnk/springframework/multitenant/oauth2/resourceserver/AutoConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.MultitenantAuthenticationManagerResolver]: Factory method 'multitenantAuthenticationManagerResolver' threw exception; nested exception is java.lang.IllegalArgumentException: trustedIssuers cannot be empty at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:800) at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:541) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1334) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1177) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:564) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:524) at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:335) at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234) at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333) at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:213) at org.springframework.boot.web.servlet.ServletContextInitializerBeans.getOrderedBeansOfType(ServletContextInitializerBeans.java:212) at org.springframework.boot.web.servlet.ServletContextInitializerBeans.addAsRegistrationBean(ServletContextInitializerBeans.java:175) at org.springframework.boot.web.servlet.ServletContextInitializerBeans.addAsRegistrationBean(ServletContextInitializerBeans.java:170) at org.springframework.boot.web.servlet.ServletContextInitializerBeans.addAdaptableBeans(ServletContextInitializerBeans.java:155) at org.springframework.boot.web.servlet.ServletContextInitializerBeans.<init>(ServletContextInitializerBeans.java:87) at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.getServletContextInitializerBeans(ServletWebServerApplicationContext.java:259) at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.selfInitialize(ServletWebServerApplicationContext.java:233) at org.springframework.boot.web.embedded.tomcat.TomcatStarter.onStartup(TomcatStarter.java:53) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5166) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1384) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1374) at java.util.concurrent.FutureTask.run$$$capture(FutureTask.java:266) at java.util.concurrent.FutureTask.run(FutureTask.java) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:134) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:909) at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:843) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1384) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1374) at java.util.concurrent.FutureTask.run$$$capture(FutureTask.java:266) at java.util.concurrent.FutureTask.run(FutureTask.java) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:134) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:909) at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:262) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardService.startInternal(StandardService.java:434) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:930) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.startup.Tomcat.start(Tomcat.java:486) at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.initialize(TomcatWebServer.java:123) ... 14 common frames omitted Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'multitenantAuthenticationManagerResolver' defined in class path resource [io/mzlnk/springframework/multitenant/oauth2/resourceserver/AutoConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.MultitenantAuthenticationManagerResolver]: Factory method 'multitenantAuthenticationManagerResolver' threw exception; nested exception is java.lang.IllegalArgumentException: trustedIssuers cannot be empty at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:658) at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:638) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1334) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1177) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:564) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:524) at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:335) at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234) at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333) at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208) at org.springframework.beans.factory.config.DependencyDescriptor.resolveCandidate(DependencyDescriptor.java:276) at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1380) at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:1300) at org.springframework.beans.factory.support.ConstructorResolver.resolveAutowiredArgument(ConstructorResolver.java:887) at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:791) ... 57 common frames omitted Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.MultitenantAuthenticationManagerResolver]: Factory method 'multitenantAuthenticationManagerResolver' threw exception; nested exception is java.lang.IllegalArgumentException: trustedIssuers cannot be empty at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:185) at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653) ... 71 common frames omitted Caused by: java.lang.IllegalArgumentException: trustedIssuers cannot be empty at org.springframework.util.Assert.notEmpty(Assert.java:470) at org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver.<init>(JwtIssuerAuthenticationManagerResolver.java:85) at io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.jwt.JwtAuthenticationManagerResolver$Builder.withTrustedIssuerResolver(JwtAuthenticationManagerResolver.java:51) at io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.MultitenantAuthenticationManagerResolver.jwtResolver(MultitenantAuthenticationManagerResolver.java:135) at io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.MultitenantAuthenticationManagerResolver.<init>(MultitenantAuthenticationManagerResolver.java:48) at io.mzlnk.springframework.multitenant.oauth2.resourceserver.AutoConfiguration.multitenantAuthenticationManagerResolver(AutoConfiguration.java:43) at io.mzlnk.springframework.multitenant.oauth2.resourceserver.AutoConfiguration$$EnhancerBySpringCGLIB$$31a4e25a.CGLIB$multitenantAuthenticationManagerResolver$0(<generated>) at io.mzlnk.springframework.multitenant.oauth2.resourceserver.AutoConfiguration$$EnhancerBySpringCGLIB$$31a4e25a$$FastClassBySpringCGLIB$$14ca0748.invoke(<generated>) at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:244) at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:331) at io.mzlnk.springframework.multitenant.oauth2.resourceserver.AutoConfiguration$$EnhancerBySpringCGLIB$$31a4e25a.multitenantAuthenticationManagerResolver(<generated>) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154) ... 72 common frames omitted

Investigate and remove unnecessary dependencies from starter and autoconfigure pom.xml

Investigate and remove unnecessary dependencies from starter and autoconfigure pom.xml files to make the starter lightweight. Such an improvement also prevents from loading unnecessary Spring Boot starters and their autoconfigurations, etc.

Authorization failed while using JWT tokens

User is given Authorization failed while using JWT tokens despite using valid token and jwt-issuer-uri. However, this issue does not appear while using jwt-public-key stored locally.

Cannot resolve io.mzlnk.springframework:multi-tenant-oauth2-resource-server-spring-boot-starter:1.0

For now, building demo project is impossible because of invalid autoconfigure version in pom.xml. As a result, the following error is shown: Cannot resolve io.mzlnk.springframework:multi-tenant-oauth2-resource-server-spring-boot-starter:1.0

Add possibility to resolve token with different ways

Add possibility to resolve token with different ways, e.g.:

• via Authorization header
• via cookie

This feature should be customizable via application configuration properties

Add custom JwtAuthenticationConverter behaviour

Hi,

It would be great to be able to manage by our own the content of the Spring Authentication by custom JwtAuthenticationConverter behaviour to be able to add informations to Authorities.

Actually, adding jwt().jwtAuthenticationConverter(myJwtAuthenticationConverter()) fails due to authentication resolver precedence.

Fix NullPointerException when no JWT public keys are provided

For now, if you provide no JWT public keys via application.yml, the application fails to start giving NullPointerException with a message:

Caused by: java.lang.IllegalArgumentException: publicKeys cannot be empty
	at org.springframework.util.Assert.notEmpty(Assert.java:555) ~[spring-core-5.3.6.jar:5.3.6]
	at io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.jwt.PublicKeyJwtAuthenticationManagerResolver.<init>(PublicKeyJwtAuthenticationManagerResolver.java:21) ~[classes/:na]
	at io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.jwt.JwtAuthenticationManagerResolver$Builder.withPublicKeyResolver(JwtAuthenticationManagerResolver.java:45) ~[classes/:na]
	at io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.MultitenantAuthenticationManagerResolver.jwtResolver(MultitenantAuthenticationManagerResolver.java:125) ~[classes/:na]
	at io.mzlnk.springframework.multitenant.oauth2.resourceserver.resolver.MultitenantAuthenticationManagerResolver.<init>(MultitenantAuthenticationManagerResolver.java:45) ~[classes/:na]
	at io.mzlnk.springframework.multitenant.oauth2.resourceserver.AutoConfiguration.multitenantAuthenticationManagerResolver(AutoConfiguration.java:41) ~[classes/:na]
	at io.mzlnk.springframework.multitenant.oauth2.resourceserver.AutoConfiguration$$EnhancerBySpringCGLIB$$ba44f155.CGLIB$multitenantAuthenticationManagerResolver$2(<generated>) ~[classes/:na]
	at io.mzlnk.springframework.multitenant.oauth2.resourceserver.AutoConfiguration$$EnhancerBySpringCGLIB$$ba44f155$$FastClassBySpringCGLIB$$c582bce8.invoke(<generated>) ~[classes/:na]
	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:244) ~[spring-core-5.3.6.jar:5.3.6]
	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:331) ~[spring-context-5.3.6.jar:5.3.6]
	at io.mzlnk.springframework.multitenant.oauth2.resourceserver.AutoConfiguration$$EnhancerBySpringCGLIB$$ba44f155.multitenantAuthenticationManagerResolver(<generated>) ~[classes/:na]
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na]
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:78) ~[na:na]
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na]
	at java.base/java.lang.reflect.Method.invoke(Method.java:567) ~[na:na]
	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154) ~[spring-beans-5.3.6.jar:5.3.6]