grpc-ecosystem / grpc-ecosystem/grpc-spring

Config for OAuth2 JWT Security with Shared Keys

Open
#244 7 comments 0 reactions 0 assignees View on GitHub
examples
Dominant language
Java
Stars
3.7k
Forks
858
PR merge metrics
No merged PRs in 30d

Description

How would you configure the starter to work with OAuth2 JWTs using shared signing keys in a reactive gRPC service?

We see [this example](https://github.com/yidongnan/grpc-spring-boot-starter/blob/master/examples/security-grpc-bearerAuth-server/src/main/java/net/devh/boot/grpc/examples/security/server/SecurityConfiguration.java), but it's non-reactive, uses OpenId and uses a Keycloak server to validate the JWTs.

Here's more detail on our use case, which we think is pretty standard:
1. We obtain JWTs from a Spring OAuth2 server.
2. We supply the JWT as a bearer token in the `Authorization` header to each gRPC request.
3. We need the server to the following on each call:
a. Retrieve the JWT from the header.
b. Validate the signature using a shared symmetric key that we'll provide to the service.
c. Parse the JWT, extracting the `authorities` claim array.
d. Set the Spring Security principal to include all authorities in the JWT.
4. Then we'll be able to annotate our service methods with `@PreAuthorize("hasAuthority('some-right')")`.

Also we're using reactive gRPC, so need to leverage Reactive Spring Security.

Thanks.

Contributor guide

Open the contributing guide

Research direction

Start by reading examples/security-grpc-bearerAuth-server/src/main/java/net/devh/boot/grpc/examples/security/server/SecurityConfiguration.java and compare it with Reactive Spring Security support for a reactive gRPC service. Done means bearer JWTs are read from each gRPC request, validated with the supplied shared key, mapped from the authorities claim into the principal, and usable by @PreAuthorize.

Written by the indexing model from the issue text.

Assessment

Tech stack
grpc, java, spring-boot
Domain
authentication, authorization, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.