grpc-ecosystem / grpc-ecosystem/grpc-spring
Config for OAuth2 JWT Security with Shared Keys
- Dominant language
- Java
- Stars
- 3.7k
- Forks
- 858
- PR merge metrics
- No merged PRs in 30d
Description
How would you configure the starter to work with OAuth2 JWTs using shared signing keys in a reactive gRPC service?
We see [this example](https://github.com/yidongnan/grpc-spring-boot-starter/blob/master/examples/security-grpc-bearerAuth-server/src/main/java/net/devh/boot/grpc/examples/security/server/SecurityConfiguration.java), but it's non-reactive, uses OpenId and uses a Keycloak server to validate the JWTs.
Here's more detail on our use case, which we think is pretty standard:
1. We obtain JWTs from a Spring OAuth2 server.
2. We supply the JWT as a bearer token in the `Authorization` header to each gRPC request.
3. We need the server to the following on each call:
a. Retrieve the JWT from the header.
b. Validate the signature using a shared symmetric key that we'll provide to the service.
c. Parse the JWT, extracting the `authorities` claim array.
d. Set the Spring Security principal to include all authorities in the JWT.
4. Then we'll be able to annotate our service methods with `@PreAuthorize("hasAuthority('some-right')")`.
Also we're using reactive gRPC, so need to leverage Reactive Spring Security.
Thanks.
Contributor guide
Research direction
Start by reading examples/security-grpc-bearerAuth-server/src/main/java/net/devh/boot/grpc/examples/security/server/SecurityConfiguration.java and compare it with Reactive Spring Security support for a reactive gRPC service. Done means bearer JWTs are read from each gRPC request, validated with the supplied shared key, mapped from the authorities claim into the principal, and usable by @PreAuthorize.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, java, spring-boot
- Domain
- authentication, authorization, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100