Spring Security

Agar Spring Security classpath ichida bo'lsa, veb-ilovalar odatda himoyalangan bo'ladi. Spring Boot Spring Security ning content negotiation strategiyasiga tayanadi, qaysi birini ishlatishni aniqlash uchun: httpBasic yoki formLogin. Veb-ilovada metod darajadagi xavfsizlik vositalarini joylashtirish uchun @EnableGlobalMethodSecurity annotatsiyasini qo'shishingiz mumkin.

Default bo'yicha UserDetailsService bir foydalanuvchi uchun taqdim etiladi. Foydalanuvchi ismi – user, va parol – tasodifiy tanlanadi va dastur ishga tushganda WARN darajasida chiqariladi, quyidagi misol kabi:

Using generated security password: 78fa095d-3f4c-48b1-ad50-e24c31d5cf35
This generated password is for development use only. Your security configuration must be updated before running your application in production.

Foydalanuvchi nomi va parolini spring.security.user.name va spring.security.user.password ko'rsatib o'zgartirishingiz mumkin.

Veb-ilovada sizga default bo'yicha taqdim etilgan asosiy funksiyalar quyidagilar:

• UserDetailsService (yoki WebFlux ilovasida ReactiveUserDetailsService) bilan bir foydalanuvchi va sdflaryapilib, xotira qilinadi (foydalanuvchi xususiyatlari SecurityProperties.User da ko'ring).

• Barcha ilovada (agar actuator classpath ichida bo'lsa actuator endpointlar qo'shadi) formLogin yoki HTTP Basic (so'rov ichidagi Accept headerga qarab) bilan kirish.

• Authentication voqealarini e'lon qilish uchun DefaultAuthenticationEventPublisher.

Agar boshqa AuthenticationEventPublisher istasangiz, faqat shunga mos bir bean qo'shing.

MVC uchun xavfsizlik vositalari

Default xavfsizlik vositalari konfiguratsiyasi SecurityAutoConfiguration va UserDetailsServiceAutoConfiguration da amalga oshiriladi. SecurityAutoConfiguration veb xavfsizligini ta'minlash uchun SpringBootWebSecurityConfiguration ni import qiladi, va UserDetailsServiceAutoConfiguration autentifikatsiyani konfiguratsiya qiladi, bu vebga bog'liq bo'lmagan ilovalar uchun ham dolzarbdir. Veb-ilova xavfsizlik vositalarining default konfiguratsiyasini butunlay o'chirib qo'yish yoki bir nechta Spring Security komponentlarini (masalan OAuth2 resource client va server) birlashtirish uchun, SecurityFilterChain turida bean qo'shing (bu esa UserDetailsService yoki Actuator xavfsizlik vositalari konfiguratsiyasini o'chirmaydi).

UserDetailsService konfiguratsiyasini boshqalar bilan bir qatorda o'chirib tashlash uchun, UserDetailsService, AuthenticationProvider yoki AuthenticationManager turida bean qo'shing.

Foydalanuvchi kirish qoidalarini moslashtirilgan SecurityFilterChain yoki WebSecurityConfigurerAdapter qo'shib qayta o'rnatishingiz mumkin. Spring Boot actuator endpointlar va statik resurslar uchun kirish qoidalarini qayta o'rnatish uchun yordamchi methodlar taqdim etadi. EndpointRequest management.endpoints.web.base-path xususiyatiga asoslangan RequestMatcher yaratishni ishlatishingiz mumkin. PathRequest keng tarqalgan joylashuvlarda turgan resurslar uchun RequestMatcher yaratish uchun ishlatishingiz mumkin.

WebFlux-da xavfsizlik

Spring MVC ilovalari kabi, WebFlux ilovalarini himoyalash uchun, spring-boot-starter-security qaramligini qo'shishingiz mumkin. Default xavfsizlik vositalari konfiguratsiyasi ReactiveSecurityAutoConfiguration va UserDetailsServiceAutoConfiguration da amalga oshiriladi. ReactiveSecurityAutoConfiguration veb xavfsizligini ta'minlash uchun WebFluxSecurityConfiguration ni import qiladi, va UserDetailsServiceAutoConfiguration autentifikatsiyani konfiguratsiya qiladi, bu vebga bog'liq bo'lmagan ilovalar uchun ham dolzarbdir. Veb-ilova xavfsizlik vositalarining default konfiguratsiyasini butunlay o'chirib qo'yish uchun, WebFilterChainProxy turida bean qo'shishingiz mumkin (bu esa UserDetailsService yoki Actuator xavfsizlik vositalari konfiguratsiyasini o'chirmaydi).

UserDetailsService konfiguratsiyasini boshqa bilan bir qatorda o'chirib tashlash uchun, ReactiveUserDetailsService yoki ReactiveAuthenticationManager turida bean qo'shing.

Kiruvchi qoidalar va bir nechta Spring Security komponentlarini, masalan OAuth 2 client va resource serverni ishlatish uchun, moslashtirilgan SecurityWebFilterChain bean ni qo'shing. Spring Boot yordamchi methodlar taqdim etadi, ular actuator endpointlari va statik resurslar uchun kirish qoidalarini qayta o'rganish uchun ishlatilishi mumkin. EndpointRequest management.endpoints.web.base-path xususiyatiga qaratilgan ServerWebExchangeMatcher yaratish uchun ishlatilishi mumkin.

PathRequest keng tarqalgan joylashuvlardagi resurslar uchun ServerWebExchangeMatcher yaratish uchun ishlatilishi mumkin.

Misol uchun, quyidagi kabi xavfsizlik vositalari konfiguratsiyasini sozlashingiz mumkin:

import org.springframework.boot.autoconfigure.security.reactive.PathRequest; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.web.server.ServerHttpSecurity; import org.springframework.security.web.server.SecurityWebFilterChain; import static org.springframework.security.config.Customizer.withDefaults; @Configuration(proxyBeanMethods = false) public class MyWebFluxSecurityConfiguration { @Bean public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { http.authorizeExchange((exchange) -> { exchange.matchers(PathRequest.toStaticResources().atCommonLocations()).permitAll(); exchange.pathMatchers("/foo", "/bar").authenticated(); }); http.formLogin(withDefaults()); return http.build(); } } 

import org.springframework.boot.autoconfigure.security.reactive.PathRequest import org.springframework.context.annotation.Bean import org.springframework.context.annotation.Configuration import org.springframework.security.config.web.server.ServerHttpSecurity import org.springframework.security.web.server.SecurityWebFilterChain @Configuration(proxyBeanMethods = false) class MyWebFluxSecurityConfiguration { @Bean fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain { http.authorizeExchange { spec -> spec.matchers(PathRequest.toStaticResources().atCommonLocations()).permitAll() spec.pathMatchers("/foo", "/bar").authenticated() } http.formLogin() return http.build() } } 

OAuth2

OAuth2 - bu keng qo'llaniladigan autentifikatsiya tizimi bo'lib, Spring tomonidan qo'llab-quvvatlanadi.

Mijoz

Agar classpath ichida spring-security-oauth2-client bo'lsa, OAuth2/Open ID Connect mijozlarini o'rnatish uchun ba'zi autokonfiguratsiya imkoniyatlaridan foydalanishingiz mumkin. Ushbu konfiguratsiya OAuth2ClientProperties dagi xususiyatlarni ishlatadi. Bu xususiyatlar servlet va reaktiv ilovalar uchun ham qo'llaniladi.

Bir nechta OAuth2 mijozlari va provayderlarini spring.security.oauth2.client prefiksidan ro'yxatdan o'tkazishingiz mumkin, quyidagi misolda ko'rsatilganidek:

spring.security.oauth2.client.registration.my-client-1.client-id=abcd
spring.security.oauth2.client.registration.my-client-1.client-secret=password
spring.security.oauth2.client.registration.my-client-1.client-name=Client for user scope
spring.security.oauth2.client.registration.my-client-1.provider=my-oauth-provider
spring.security.oauth2.client.registration.my-client-1.scope=user
spring.security.oauth2.client.registration.my-client-1.redirect-uri=https://my-redirect-uri.com
spring.security.oauth2.client.registration.my-client-1.client-authentication-method=basic
spring.security.oauth2.client.registration.my-client-1.authorization-grant-type=authorization-code
spring.security.oauth2.client.registration.my-client-2.client-id=abcd
spring.security.oauth2.client.registration.my-client-2.client-secret=password
spring.security.oauth2.client.registration.my-client-2.client-name=Client for email scope
spring.security.oauth2.client.registration.my-client-2.provider=my-oauth-provider
spring.security.oauth2.client.registration.my-client-2.scope=email
spring.security.oauth2.client.registration.my-client-2.redirect-uri=https://my-redirect-uri.com
spring.security.oauth2.client.registration.my-client-2.client-authentication-method=basic
spring.security.oauth2.client.registration.my-client-2.authorization-grant-type=authorization_code
spring.security.oauth2.client.provider.my-oauth-provider.authorization-uri=https://my-auth-server/oauth/authorize
spring.security.oauth2.client.provider.my-oauth-provider.token-uri=https://my-auth-server/oauth/token
spring.security.oauth2.client.provider.my-oauth-provider.user-info-uri=https://my-auth-server/userinfo
spring.security.oauth2.client.provider.my-oauth-provider.user-info-authentication-method=header
spring.security.oauth2.client.provider.my-oauth-provider.jwk-set-uri=https://my-auth-server/token_keys
spring.security.oauth2.client.provider.my-oauth-provider.user-name-attribute=name

spring:
  security:
    oauth2:
      client:
        registration:
          my-client-1:
            client-id: "abcd"
            client-secret: "password"
            client-name: "Client for user scope"
            provider: "my-oauth-provider"
            scope: "user"
            redirect-uri: "https://my-redirect-uri.com"
            client-authentication-method: "basic"
            authorization-grant-type: "authorization-code"
          my-client-2:
            client-id: "abcd"
            client-secret: "password"
            client-name: "Client for email scope"
            provider: "my-oauth-provider"
            scope: "email"
            redirect-uri: "https://my-redirect-uri.com"
            client-authentication-method: "basic"
            authorization-grant-type: "authorization_code"
        provider:
          my-oauth-provider:
            authorization-uri: "https://my-auth-server/oauth/authorize"
            token-uri: "https://my-auth-server/oauth/token"
            user-info-uri: "https://my-auth-server/userinfo"
            user-info-authentication-method: "header"
            jwk-set-uri: "https://my-auth-server/token_keys"
            user-name-attribute: "name"

OpenID Connect provayderlari uchun, OpenID Connect kashfiyotini qo'llab-quvvatlaydigan, konfiguratsiyani yanada soddalashtirish mumkin. Provayder issuer-uri yordamida, ya'ni identifikator URI bilan konfiguratsiya qilingan bo'lishi kerak. Misol uchun, agar issuer-uri “https://example.com” bo'lsa, OpenID Provider Configuration Request “https://example.com/.well-known/openid-configuration” ga amalga oshiriladi. Natijada OpenID Provider Configuration Response qaytarilishi kutiladi. Quyidagi misolda issuer-uri yordamida OpenID Connect provayderini qanday konfiguratsiya qilish mumkinligi ko'rsatilgan:

spring.security.oauth2.client.provider.oidc-provider.issuer-uri=https://dev-123456.oktapreview.com/oauth2/default/

spring:
  security:
    oauth2:
      client:
        provider:
          oidc-provider:
            issuer-uri: "https://dev-123456.oktapreview.com/oauth2/default/"

Spring Security dagi OAuth2LoginAuthenticationFilter default bo'yicha faqat /login/oauth2/code/* URI-larni qayta ishlaydi. Agar redirect-uri ni boshqa shablonni ishlatishga moslashtirish kerak bo'lsa, ushbu shablon uchun qayta ishlash konfiguratsiyasini yaratish kerak bo'ladi. Misol uchun, servlet ilovalari uchun, quyidagi kabi moslashtirilgan SecurityFilterChain ni qo'shishingiz mumkin:

import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.web.SecurityFilterChain; @Configuration(proxyBeanMethods = false) public class MyOAuthClientConfiguration { @Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { http.authorizeRequests((requests) -> requests.anyRequest().authenticated()); http.oauth2Login((login) -> login.redirectionEndpoint().baseUri("custom-callback")); return http.build(); } } 

import org.springframework.context.annotation.Bean import org.springframework.context.annotation.Configuration import org.springframework.security.config.annotation.web.builders.HttpSecurity import org.springframework.security.web.SecurityFilterChain @Configuration(proxyBeanMethods = false) class MyOAuthClientConfiguration { @Bean fun securityFilterChain(http: HttpSecurity): SecurityFilterChain { http.authorizeRequests().anyRequest().authenticated() http.oauth2Login().redirectionEndpoint().baseUri("custom-callback") return http.build() } } 

Mashhur provayderlar uchun OAuth2 mijozlarni ro'yxatdan o'tkazish

Google, Github, Facebook va Okta kabi keng tarqalgan OAuth2 va OpenID provayderlari uchun, biz default bo'yicha provayderlar to'plamini taqdim etamiz (google, github, facebook va okta mos ravishda).

Agar bu provayderlarni sozlash kerak bo'lmasa, siz default qiymatlarni chiqarish uchun provayderning provider atributini o'rnating. Agar mijozni ro'yxatga olish kaliti default bo'yicha qo'llab-quvvatlanadigan provayder bilan mos kelsa, Spring Boot buni ham aniqlaydi.

Boshqa so'zlar bilan aytganda, quyidagi misoldagi ikkala konfiguratsiya Google provayderidan foydalanadi:

spring.security.oauth2.client.registration.my-client.client-id=abcd
spring.security.oauth2.client.registration.my-client.client-secret=password
spring.security.oauth2.client.registration.my-client.provider=google
spring.security.oauth2.client.registration.google.client-id=abcd
spring.security.oauth2.client.registration.google.client-secret=password

spring:
  security:
    oauth2:
      client:
        registration:
          my-client:
            client-id: "abcd"
            client-secret: "password"
            provider: "google"
          google:
            client-id: "abcd"
            client-secret: "password"

Resurs Server

Agar classpath ichida spring-security-oauth2-resource-server bo'lsa, Spring Boot OAuth2 resurs serverini o'rnatishi mumkin. JWT konfiguratsiyasi uchun, quyidagi misollar koʻrsatilgandek JWK Set URI yoki OIDC Issuer URI ni koʻrsatishingiz kerak:

spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://example.com/oauth2/default/v1/keys

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri: "https://example.com/oauth2/default/v1/keys"

spring.security.oauth2.resourceserver.jwt.issuer-uri=https://dev-123456.oktapreview.com/oauth2/default/

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: "https://dev-123456.oktapreview.com/oauth2/default/"

Bir xil xususiyatlar servlet va reaktiv ilovalarga ham tegishli.

Bundan tashqari, servlet ilovalari uchun o'zingizning JwtDecoder bean yoki reaktiv ilovalar uchun ReactiveJwtDecoder aniqlashingiz mumkin.

Agar JWT o'rniga noaniq tokenlar ishlatilsa, tokenlarni introspektsiya orqali tekshirish uchun quyidagi xususiyatlarni sozlashingiz mumkin:

spring.security.oauth2.resourceserver.opaquetoken.introspection-uri=https://example.com/check-token
spring.security.oauth2.resourceserver.opaquetoken.client-id=my-client-id
spring.security.oauth2.resourceserver.opaquetoken.client-secret=my-client-secret

spring:
  security:
    oauth2:
      resourceserver:
        opaquetoken:
          introspection-uri: "https://example.com/check-token"
          client-id: "my-client-id"
          client-secret: "my-client-secret"

Boshqa misolda, servlet ilovalar uchun o'zingizning OpaqueTokenIntrospector bean yoki reaktiv ilovalar uchun ReactiveOpaqueTokenIntrospector yaratishingiz mumkin.

Authorization Server

Hozirda Spring Security OAuth 2.0 avtorizatsiya serverining implementatsiyasini qo'llab-quvvatlamaydi. Biroq, ushbu funksionallik Spring Security OAuth loyihasidan mavjud bo'lib, u vaqt o'tishi bilan Spring Security tomonidan to'liq almashtiriladi. Shu vaqtgacha, OAuth 2.0 avtorizatsiya serverining oddiy sozlamalari uchun spring-security-oauth2-autoconfigure modulidan foydalanishingiz mumkin; ko'rsatmalarni o'qish uchun hujjatlar ga qarang.