Spring Authorization Server Tutorial: Boot 3.1 Auto-Config

[00:00:00]foreign [Music] [Music] [Music] thank you [Music] [Music] thank you away thank you [Music] [Music] [Music] thank you [Music] [Music] thank you foreign [Music] [Applause] [Music] thank you [Music] I think we did it okay I I think you're I think people are excited about this one you know I can tell there's more people here than normally when I'm just three minutes into the uh into the show so let's just get right into it then uh Steve awesome I appreciate you being here buddy like this is a you know I'd like to say this is a big well-conceived pre-planned thing but no basically I woke up and I'm like I'll bet Steve could help me today I'll bet he would help me get the help get me to production uh because I said I wanted to go from like from from stupid to secure like this morning and then uh to make things more complicated I've got a dentist appointment in two hours so we have to go from stupid to secure with enough time for me to get in the car and take a 15 minute Uber ride to downtown where there's no parking so um all right well I think we could do it what do you think we can do it with you there's no doubt if it was just me we'd just be sitting here for like I don't know we'd probably devolve into like I don't know something else it's very sad so so the so we've got um uh for the for the background here they're in this in Spring Security five which came out five plus years ago we slowly started the work of subsuming the Spring Security oauth project the Standalone Spring Security Olaf project which offered three things right one is the um the ability to do oauth clients like uh login that kind of stuff uh oidc that kind of stuff then there's oauth resource server support so you can actually take an API and protect it and by accepting a token and all that uh and then there was finally Spring Security oauth authorization server and that piece at first we kind of punched it on that didn't we we kind of said nah we're not going to do that there are plenty of existing options out there that are quite good like key cloak like uh OCTA like off zero at the time there are two different things you know lots of things out there that you could have used uh rather than our thing um and I think you know it's an example of the community saying no that's right we insist really so so how I mean we we created this um skeletal GitHub repository and I think the idea was that we would just mentor some people on the outside and then it just got like like a crap ton of attention I mean it was one of our most voted up discussions and issues ever right um so I guess that you know the community is like no insist we we want you to focus on this so so we did and then and we you know the spring authorization server is not in of itself all that new it's been around now in some years before a couple years but having it in this new spring boot through that one release which is just packed to the gills with cool stuff already I mean just under the covers is just like an oh one more thing like this like the Steve Jobs in one more thing right right as you're about to get off stage there's a full freaking authorization server in it now right another thing you don't ever want you know like so I didn't even I didn't even notice that was coming I was so focused on the test containers and the docker compose and uh you know there's even the SSL bundle stuff there's just a lot of great stuff and then kind of buried in the readme is you know like right yeah so anyway that was exciting yeah it's so exciting like yeah yeah it's a it's a big deal um so what does the authorization server do like it's it's an oauth IDP right like that's right you can I mean you can basically use it to Mint tokens and you have a lot of different flows that are supported and so you know when you think about an oauth 2 server you might just think of a plain authorization use case you know I want an admin to be able to access resources or or some kind of service to service architecture but it does more than that it does open ID connect it does um you know oauth2 login so you can use it to secure your applications as well so it does a lot of stuff out of the box absolutely it's and so okay so we're already getting questions great questions hello everybody by the way look at all these wonderful people that have joined us really they're here to see you Steve this is you know these these these people know I'm a clown they know what's good today they showed up so hello Amit good to see you uh good morning hello that's myself uh good morning Raja good to see you thanks for joining us today hello Simon again how are you buddy uh Serengeti Sun good to see you again Hi how are you hello Siva good to see you buddy um let's see hello hi good evening uh hello you know just lots of people Friday evening is saved Steve Steve wow don't screw this up that poor person's uh Saturday it's Friday evening depends on this going well right foreign San Francisco where are you where in the world are you my friend I'm in Omaha Nebraska if you've ever heard of it all the great snakes that's right yeah yeah uh Omaha Nebraska hello hello hi hello look at all these people look at all these wonderful people that want to learn about uh oauth and spring authorization server and uh and all that stuff Hello everybody good to see you all uh we have a good question already from our friend in Morocco does the spring authorization server work with Facebook or Google like Kiko I didn't find any example since it's relatively new well as it happens in the last release we've added a how-to guide on exactly that topic so if you want to head over to the project page you can get uh to our our reference documentation and from there there's a list of how-to guides and one of them is how to do that oh that's so cool pressure exactly time uh from beginning West Africa yeah very small world I love it how to convince stakeholders to move to Spring authorization server hmm it's a it's you know one of the nice things about the authorization server is it's just a little tiny Library they may not even know this you know right yeah no I mean what does that conversation look like in New York right yeah yeah no golf games required um okay let's just I just want to see it let's just make it happen so we're gonna go to I'm gonna share my screen here okay um and again you're gonna be my my uh security Sherpa my my uh my uh my yoda right so let's see um what about spring oauth with Google identity I think that's didn't we just talk about that I think we just talked about that that's another question okay um okay so you can see my screen right I've done absolutely zero prep so my hope is we start here we go to start that spring rail I call this what off server right like that yeah um and then authorization server yeah I mean that's that's good that's it right so what about the gravian story how's that look right now so you can add girl VM as well yeah absolutely yes uh oh yeah actually we even just got a question right that we even just got a question uh I want to know if it'll be ultra lightweight thanks to aot with spring native images yes I guess we have the answer okay first things first let's get it working and then we get it fast right that's right so anything else do I need a persistence layer what's the default repository the default is in memory uh and I think that'd probably be the easiest one to use for for kind of today's demo since we haven't practiced yeah okay let me see I've got you can see I've been running code get rid of all that enter squeeze okay it's loading downloading everything you literally just come on download the internet go for it faster it's not like it hasn't seen this before that's what I don't get is we couldn't pre-compute some of this stuff I feel like it just needs to okay anyway this is not that's a rant for another year um I don't think most people have my problem which is I'm running brand new chunks of code every day on different libraries right of course I get a little tired with I get tired of uh the the caching the index computation and all that and so what what does this get me if I just run it right now am I already in a good place or uh so if you run it right now because you don't have any clients registered uh the auto configuration in Spring boot won't kick in and so you'll just have a regular web application at this point okay you know I don't I'm I'm I like regular but I want more so right with Properties or is there an apis you should be looking at so we can do with properties um if you have the blog post that I I wrote last week we can grab some properties from there oh yes look at this great blog post I'm going to put this in the chat here people um okay here we go great blog post here we go or I guess this is this week was it May 24th yeah two days ago it just feels it's been a whole week since then it's it's a packed week yeah that's right um okay so you have a new superpower exactly damn right Steve absolutely look at that new superpower this should be the only way we talk about what's just happened here uh I agree I agree okay so uh open source framework built on top of Spring Security that allows you okay getting started so you need these properties now you could do yaml but I'm uh I'm a long-suffering python programmer and if I've learned anything it's at spaces can't be trusted so I'm going to just use properties um okay this is it here we go admin client what is this password do I want to know can we tell anybody or is that you could tell you can tell everybody yeah that it's a secret though so so everybody who who knows has to keep it a secret no it's it's it's just the hashed word secret and so I just kind of wanted to show that if you have like the spring CLI installed you can kind of you you have that superpower as well you can hash passwords so there you go so is I might need to update mine but you can install it from Homebrew I think right so you know so spring and then you do what is it uh spring encode password and then you just give it the word secret or something more complicated than that all right there you go or so that should be equal to what we just had there um let me see it goes font a little smaller you can still read that okay so if we look at that it's a dollar sign two ending in with p z w oh I got a different result than you did yeah it's salted so every time you do it it'll be different but it still works yep okay okay so we have uh we can you can do that easily spring code password secret we have a secret here um client secret basic so office authentication methods what does that mean so in this case we're we're just going to start with a simple one which means we want to authenticate as our client using HTTP basic authentication so that's just kind of that that typical basic authorization header that we'll be using so okay and so this is there's there's this is this refers to the kind of authorizations that we support our client using so in this case we're saying like client credentials like username and password basically is that the idea yeah exactly we'll just use a a client ID and a client secret and get a token that's all we're going to do to start out yep oh Simon Simon Simon Simon what so we Simon says we need to go to settings tools let's see settings tools right tools I'm in settings where's my tools okay do you see wait shared indexes he's got like he just mentioned something about shared in indexes here we go ah wait suspend local indexing to wait for sharing it helps to reduce okay download automatically am I not doing this hmm wait for sure what am I supposed to do here Simon talk to me buddy um okay well we'll come back to it that's worth a whole other thread but thank you okay so so we got this password client credentials what are the alternatives to this there's a like you know authorization code we might use and uh yeah so this is this is just taking a string there's the the reason for that is that you can actually create custom uh authorization Grant types as well so it's very extensible [Music] I see okay okay very cool so I'm sure you can look it up in the documentation or something for the default ones that are out of the box but um just standard Olaf stuff right with that's right looks like Okay um uh okay good so we've got Scopes these are arbitrary right are these uh oidc or can you create your own as well like no these are we can create our own so yeah whatever we're securing we can start kind of creating our own authorization scheme right now yeah okay well let's just start with what you got right what you got is already interesting and and then we go down here to griddle boot Run Okay so is that it that's it that's it let's do it man that's disgusting really okay hold on I'm I am uh offended by how easily easy that is it like this is just oh my God look at that look at that it Okay so we've got this we got a um wow wow okay it's using uh the uh yeah get back here it's using patchy Tomcat port 8080 all of that it's up and running it's got an in-memory repository and by the way so there are a few dimensions of like persistence right I need to store stuff for so um applying credentials uh the session State I guess whatever I mean what are the some like right so in our example we're just using uh the client credentials to get started and so really we want to focus on storing our authorizations and so if you're if you're administering an authorization server you would probably store those authorizations in a database uh and so we do have a jdbc registered client repository in the jdbc oauth 2 authorization service and if you plug both of those in you're you're persisting that that stuff now so are those just beans that you define to override this right that's right you just Define those as beans and yeah you're up and running okay perfect um so how do I test this I guess we go to your blog huh this is yes let's do it so I'm using HTTP pie are you using yeah I mean I could do let's see whoa okay http okay so let's try it so we're going to make a post call to port 8080 on my Local Host to the of2 Token endpoint we're going to say that the grant type is client credentials and the scope that we want is used in our read and the authentication the oauth the the HTTP basic username and password is admin client and secret is that correct that's correct you got it ridiculous I love it okay so now I can just like create queue and get the uh what is it here you know dot access token or something like that right that's right uh did I do it wrong Dash R Maybe R thank you should be right I have a token so now I I mean are we done I guess we're done good night everybody I mean that's like the hard part right there is getting that token going right um yeah I mean in one sense it is but without with authorization server it's not anymore so now we get to have more fun doing other stuff right yeah okay so I've got token oh look at that can we this is a the next thing which is I wanted to inspect the token and see what that token tells us right because that token is you're it's a it's a jot is that the idea that's right it is we can decode it and look at the information contained therein so what is this I mean well let's see audience is admin client what does that mean so that's who this this token is intended for so because we're actually making the request as the client we're the admin clients that's intended for us and and that's all that that's that specifies so there could be more than one audience there you notice how it's an array but typically there will just be one nice Okay um scope user.read admin client token type bear uh let's see okay I mean like okay we've got a token I I just want to like you mentioned it could be expired uh that's what the active you know might be false if it's expired then yeah how long what's the expiry by default so so the default expiry is five minutes which we could of course configure and we can do that also with properties so if you kind of scroll a little bit further we could even play with that okay um oh I'm I'm uh I've read this blog before okay let's see so and one thing I would recommend if you go back to the post also grab um the logging level let's let's go ahead and enable Trace because we can kind of see a lot of stuff going on there if we do that yeah okay and by the way these client one is completely arbitrary right this is like you know if you could have a batch job you can have it you can have a web app you can have an iPhone client whatever that you can name that whatever you want right 100 yep elbow our buddy he's asking a great question which is what was used to sign the token I didn't see extra keys in the config Fair Point yeah so the spring uh boot Auto config comes out of the box with a generated key so we're kind of aiding the getting started experience when using spring boot here and so you're gonna get a lot of stuff in memory you're going to get a lot of stuff generated and so that's one of those things so if we were to restart the server like you just did that key that we signed in the previous session is now invalid there's no public key that matches that uh right so that token wouldn't work anymore yeah um so if we wanted to fix that we would probably want to start statically defining our keys and uh and so that's kind of the next the next level yeah okay let's let's let's just go through that again so I'll go create a new token okay again right that fair like this one yeah I've got the token um and now I want to make that call and type it again okay um so if we give it about 30 seconds we'll we'll see that that token should should no longer be valid and 30 seconds is really short so I don't recommend taking that to production but you know you could right yep um well so it so that 30 seconds it's all in memory right you're keeping State on the server side associated with this token uh so obviously bear that in mind like you could um you could uh write this to a disk or file system or something or a database or something um in the meantime since we've got like 25 more seconds uh Amit asks how to innovate oauth2 server uh with siteminder authentication do we have any support in this uh I haven't used site minor in 15 years I don't know right so I'd have to know a little more about the use case but um you know authorization servers built on Spring Security so any authentication mechanism that you're used to using will work for you oh yeah and so that's that's a really nice benefit of this yep very very good um okay you think it's been 30 seconds I think so so what do we want to do want to try inspecting it again yeah let's do it false yeah locked out denied okay so yeah if you want to check your console you can kind of see uh the trace of that request and wow there's there's a lot of output there okay oh so in Booking okay I guess this is the start of a request what's the most recent one here we go first one yep so if you look for oauth 2 token that might get you to the beginning of the request securing post to oauth2 token invoking the disable encode URL filter these different filters header so these are all just like Spring Security yeah 300 just so you just keep going I don't have CSR protection finally okay oidc logout endpoint filter so we I guess at this point it's realized the filter has been invalidated so it's invalidated our session our state well yeah but we we'll have to keep going to find that so there's a lot of a lot of different filters in here logout's one of them we're looking for uh in particular the token introspection filter oh my goodness token intro okay everybody uh no spoilers did it pass already 21 and 20 token endpoint filter did not set security context holders since already authenticated checking authorization I lost I lost a plot I don't know I don't see it where is it I think you're you're probably on an earlier request so you're seeing when you actually uh issued the token request which is also cool we can see that what was the name of the filter again that we're looking for you had it right there token introspection oh right here whoa yeah I totally found that that was me yeah you did because you clicked on it it was amazing you all saw a chat with me told me okay um uh okay so so what does this thing do so this is what's actually processing the requests that we issued to introspect the token and so you know spring authorizations are operates at a little bit lower level than spring MVC spring spring web MVC and so it's using a filter to actually Implement an endpoint so we issued that request that goes into that filter and it's going to process the request parameters in in this case the token that you sent in and it's going to look that token up we see that here where it says retrieved authorization with token yeah and then from there it can kind of determine what it wants to do with that it's not active so it just kind of moved on not what is hsts header so that's another filter on Spring Security that's where it's writing secure headers to the response that kind of happens towards the end of the request life cycle so okay okay so we I mean this is the hard part we got a token now I want to like use this in let's say I wanted to stand up a resource server like I want to create a recipe point and then lock it down and have it get a token from here and then use that to make a request to that endpoint can we do that we can so let's I think that's perfect thing to do is let's start by building a resource server first right okay and then we can do all IDC login we we can once we would need an oauth client for that so they're kind of separated roles um so let's start with a resource server and then we'll we'll do the client right afterwards how about that so what did I I did I use good identifiers this is I call this one as I hope or officer we're going to call it auth server yeah okay good that's fine that's not bad so I'm going to call this resource server perfect service a new micro service and I'm just going to bring in Spring Security and the web support yeah let's bring in a resource server as well and since resource server kind of uh inherits from security yeah you can go ahead and get rid of that okay I mean I think that's it yeah that's it okay so we're doing the Trinity here the office server the resource server and if if if you're all good what is it client okay this is cool this is cool uh I mean it's saying the volume is not coming is everybody else able to hear uh what's happening I hope so if we're just talking to ourselves in the void that would be a real pity just put in chat that they can hear not that you're liking what you hear because I know you are but if you're we're asking if you can here of course if they couldn't hear us they wouldn't know to put it that's a good point Amel says it's fine on his side so I don't know okay as long as somebody can hear it as long as the bites are getting out across the internet somewhere okay so we're in the reserve server code and this is pretty standard stuff but uh what do we do properties yeah so let's go to the properties again uh we really only need one property to kind of get going with this guy I do need a controller though you're right about that this part I can do I got this don't worry nice I'm gonna make this happen watch this people are gonna be so impressed uh hello okay map string string oh and we want to inject the uh like I want to be able to do this with the authenticated user right so I can do authenticated principle and then uh what do I get authentication I guess there we go yeah or I think you can get a JWT directly actually in this case oh how would I just JWT yeah so I'm going to say uh hello awt dot uh subject sure yeah sounds good to me okay so I want to lock that down I don't want anybody to just be able to call the endpoint without being oh thank you okay we've got three people saying they can hear so hopefully it's uh good okay so this part I did the hard part Steve I think I think you'll agree yeah absolutely the most code we've written so far um okay so now we need a reserve server I'll bet there's a property yeah so issuer URI if you search for that in the autocomplete uh and that is it so let's just do uh HTTP colon slash localhost colon 8080. now we'll have to mess with our ports here because we're gonna have two apps running so you kind of got to ask what ports we want to use for things well so the issue or URI is the that's it yeah 80 81 okay okay and what else do we need to lock this down no that's it that's that's it you're silly you're a silly man Steve ridiculous okay up and running boom okay so now I'm gonna do the whole token Dance Again sure okay and now I just want to like can I just make a curl come on uh you um admin client with that token is that the idea uh no so we we will need an authorization header uh specifically and we'll use the bearer scheme X then what yes so then the the dollar token would get passed in there in here okay yeah yeah okay that's right and then we don't need the dash U I don't think yeah and then uh Leonard let's just hit our hello yeah uh 80 81 hello failure what did they do wrong [Music] forward slash so yeah let's get rid of that forward slash and see because it should one bump should be happier we'll see if that I didn't yeah uh so just just you know humor me for a second Josh let's can we can we do something funny well yeah sure all right let's let's enable um method Security on on this resource server can we do that yeah yeah okay at enable here we are at enable global method something something I don't know let's do just method security enable method security okay so this is new in in six well not new but but new the new default okay so what happened to the global one I just noticed that was duplicated I guess that's what happened to it it's deprecated okay that's right so this is using a different API the authorization manager API some pretty new uh well again not new but but the new default um and so it's pretty great the new service that's going to provide the response for us and we're going to forward to that is that the idea sure yeah let's do it um so it's a service how do I get access can I use security context holder in this case still uh you can um because I'm gonna have to call this thing to get the uh data yeah so in your case give me an example of what you're thinking because I think we can just we can just use annotations right we can use pre-authorizing annotations and all that good stuff right okay so um but how do I get the dot that's what I'm trying to say like how do I get the current name right so you could use the security context holder to do that yeah does it seem to be public yeah be authorized okay men turn this inside again my the signature I don't want to have to inject I don't have to pass as a parameter of the jot right um so I want to look it up through I suppose this security context holder it's yeah that's certainly one option for us okay so we get the uh get the contacts get the authentication and from there we'd get the principal pass that down to dot well yeah so I think we can cast that to yeah GWT okay and so what is the uh are we gonna use spell or were we gonna put here so yeah let's use uh has Authority so just just has Authority I don't think we need to put it in yeah make my screen brighter so I can see exactly uh so yeah scope underscore user.read and that'll be exactly right there you go and your score user dot create without the code or with the quotes with the quotes and we'll make the scope all caps sweet yeah that's it oh we're gonna called okay so I'm gonna inject that thing here final uh greetings service in the Constructor and here I'm going to make a call to that thing I'll say this dot service.greet I won't be able to call that unless I'm authenticate is that fair unless you're authenticated and have the user read scope that's right yeah okay let's try again I'm going to restart uh that old token will be expired but if it hadn't been expired already then I could still use that with even though I've restarted this a few times right now correct this this resource server is completely stateless so okay yeah so um token great mm-hmm what did I just do for my job to make it work yeah amazing okay so we just uh we just did it both ways we just uh did the like service pre-authorized and this is great for graphql by the way so if you're doing graphql uh and you want to do secure the parts of the ground object graph the controller resolvers or the services that you use to provide the data that feeds into the resolvers can be method uh method you know secured by them at the method level uh why can't we just use Auto wired for dependent you can but then like you're gonna get sad because your tests are every time you use at Auto wired and field injection uh a unit test stats every time and it's just sad just save the save the tests don't use that on auto wire it's not required for the Constructor and you shouldn't do it on fields and there's no you know I almost never find a reason to use Setters so somebody's asking about this and it's a good question I just do Constructor injection it's actually less code and the the intent is clear to everybody okay um I'm satisfied that this is amazing like I always wanted to be able to do what we just did it's been years since I've been able to do what we just did which is from Whole cloth stand up and authorization server stand up a resource server and then you know this demo could have finished before we did the method uh authentication an authorization rather uh and it was still amazing and it just got better mm-hmm well I mean what what would it what would it take to make it even better Josh what do you think oh NDC login that's what I'm like okay oh we should like is it like I feel like this is going a little too quickly I always should have like uh right we need to we need to have some problems right yeah oh it's so good um we'll try gravyam afterwards that'll take at least a minute for each build right so it'll that'll slow things up a little bit but um but okay let's go back to do we is there anything else we should know about this like this particular resource service story not really I mean unless you want to you know add maybe some kind of post endpoint um other than that I think this is this is it right and sort of what endpoint so if we want to do like a post maybe we'd we'd do something that requires our user.write scope as well okay well is that just more of this like user.writing yes or that mm-hmm one of the one of the main kind of things to show here is when we're using resource server we're not going to be using csurf tokens so we don't have to mess with that because we're going to be doing everything uh using API calls so cool yeah um that's awesome okay so this is great if you've already got the token uh the real question then comes where do you get Who who how do you incept the token and that means somewhere somewhere somewhere along the line you've got to do a login and um that's right and in oauth the idea is that you're it's actually delegated authentication right you're not doing the authentication with oauth you're delegating to something else that then signals in whatever way it does through some back channel that everything is fine and then all the rest of the conversation is about authorization newly authenticated user which gets authenticated on the domain that is trusted right um You you said that perfectly Josh are you sure you're not an expert I just I went on TV uh okay thanks uh but but uh so that's what what I'm trying to say is it's very important that the author the login happens in a place that you can see the secret padlock in the browser and everybody trusts what's happening there right um and uh so we've got a token here but we're doing it by Curl we're manually incepting a token then sending it here look for a web browser app it's not going to be great if you tell the user okay now run this curl command and then send it to this endpoint and then you can put it in this form field right there's got to be like uh right yeah so we're that's some kind of magic yeah that's so what's the magic yeah exactly what does that look like now and actually this is normally paradoxically this is the first thing people learn even though frankly I think you're better off by learning the resource server stuff first and then yeah 100 and I and I think that's that's why it's great that we've kind of done it in this order because we've proven that everything else works now so now if if we want to do the hard part which which we'll see how hard it is in the end right yeah that's really the last the last step not the first one so let's do that next okay I'm ready let's do a new service let's do a new let's call it auth client yeah third time and so many minutes off client and Olaf client look at that you yep so let me know all there right yeah it wasn't great let's do something crazy here um because we'll we'll have an easier time if we do it this way let's add spring Cloud Gateway instead of web yes yep so we don't want the uh well this brings in reactive web too right this is awesome right okay so and I don't know if we need the web flux dependency or not with Gateway um it never hurts to have it doesn't hurt so I think I think that's it okay so we're really uh spicing things up here we're gonna do a reactive client application talking to our idpr off the server okay ready oh do we want gravity we haven't actually used we haven't capitalized on that gravity and dependency on any of these three uh things yet but let's just make them all work on the jvm right okay and of client that's it okay yeah it comes with Gateway we just wanted to be sure though uh let's see here oh yeah Thanks James uh well done I'll take that I'm going to say that's that you intended it for me but uh okay uh I appreciate it yeah now Steve this is I mean seriously whatever valuable thing you've done you and the team you and the rest of our team uh have done with it the team has done a lot of work to make this possible and and even even the boot team has done a lot of work to support us just to get to Spring authors or get to Spring initializer was a huge Road and and they helped a lot so it's been it's been an awesome partnership I love it love it love to hear it love to see it love to work with it so I guess we don't right this is like there's even less code required for this unless you're gonna do something with Gateway I guess yeah and honestly that's that's probably what we're gonna do so um let's open up our our properties are you how do you feel about writing Gateway properties here I have not done that I typically use the ammo for this part so oh I so I use the Java API usually um okay that's fair I also don't use that very often so I may not be as much of a help there but I can tell you kind of what to do well so can we start with just before we get into Gateway so Gateway what are we using Gateway for so what we'll do is we'll have Gateway uh kind of act as our oauth 2 client and so it's going to manage the tokens for us kind of like as you you walked us through with that explanation and what we'll do is we'll actually proxy your request over to our resource server using Gateway so we'll Define one route that goes to that greeting endpoint and then you know that's that's it right [Music] eight way out locator here you and I are in equally uncomfortable territory but okay so we want to proxy requests to uh which one to this endpoint uh hello and send it to the localhost 8081 I think it was I think that's right yep okay it's not a proxy it it'll proxy whatever we send on this service which is on Port 8082 okay that's right that's right and then we just need one filter which is and that'll be the the token relay filter oh nice that's so freaking cool okay and lambdas left me that's right oh beautiful um so do I need to do any properties to tell it to be uh and what I see yeah so we'll need a few properties to configure the auth2 client itself do we have a registration now a new default one like Google and GitHub or whatever for like for spring we don't we don't as of yet that's a great Point uh that would be cool to have right yeah of course but we only need we only need one property really for it which is is our issue or URI so it's not too bad but 1080 so yeah that works um so what we have to do is say that provider I think here and we'll just call the provider spring and then we'll Define that registration.spring is that right yep that works no no yeah that was good perfect and then just [Music] bring and then we'll Define the provider itself so instead of registration we'll say provider we'll also Call it spring and then issuer URI there we are at the authorization server or the reader server authorization server okay and we do need probably a couple more properties for the client itself so after line two you can copy that and add a couple more here so one of them would be the client ID on the registration on the registration okay client spring ID equals um so we need to Define one because we don't have one for this yet so this is so what do we want to call it client okay and then client secret is uh decryption thing in this case uh it'll be plain text so we'll just say secret [Music] and then we'll need the authorization Grant type credentials in this case let's do authorization code okay okay you need to change the authorization types for the off server to include this now because we only have 20 Questions we will absolutely okay next let's add a client authentication method here then we'll do client secret basic again secrets eating basic yep that's it okay and we have two more the next one is redirect URI okay for this all client most important yeah so in this case let's kind of use a slightly more automatic value let's use uh in curly braces here base URL and we won't need the dollar sign in this case because it'll get substituted by Spring Security itself all right base URL slash login nice oauth 2.

[00:47:39]code and then again in curly braces slash registration ID oh registration ID registration ID okay like that and so what that's doing is saying okay whatever request to uh this back end we're making we're going to resolve the base URL using the request right and then you've called your registration ID spring so it's going to inject spring into that last variable there for you so you don't have to actually hard code that foreign and then we need one more property one more one more and that is scope oh okay all right user.read or whatever that's right so user.read but we'll need two of them actually we're going to add uh yeah you could uh you could do user right as well and then but we need open ID because we want to log in using using openid connect as if I recall correctly that was your end goal right right uh open ID how do I correctly write that I think that's right I think you can do that yep okay um okay so that's it for this side we have to go change this thing though right okay so let's go to the auth server and do that quick include that here I guess uh yes and we'll add refresh token as well so third one refresh this that means I need to read narrate the token which will have long since expired anyway but yeah one one other thing I'll point out here I think you called it clients so we might need to change the client ID here okay um just client I think you called it client yep okay right and go ahead and delete the access token time to live because that's a really short token timeout yeah there we go redirect Uris cannot be empty yeah and yeah we're going to need to add that as well and also add the open ID scope while you're in here too um open ID and then redirect your eyes is what made client off a little 8082 that's right so that's if I get both here and then the client oidc login thing yeah we'll need that full path so it'll be a login oauth 2 code login I'll ask to code like that yep and then slash spring because that's our registration ID and one thing I'll point out here too because it'll trip people up quite a bit is we're using localhost here but we have two different we're going to have two different Services running on localhost and so just to make sure depending on which stack you're using the name of the of the session cookie might be different but just to kind of avoid collisions let's use 127001 for that URL okay so that'd be even easier you could definitely do that I I tend not to just because that's one extra step for for folks to have to do but yeah we could totally do that okay for now once as long as the tokens are discriminated by that because they're not my report right they're discriminated by the the hosts this complexity doesn't exist when you deploy it to like actual IPS and stuff exactly uh so I've never felt more confident about something I didn't understand I'm ready should we can I restart this thing I think so my fingers crossed okay hey well look at that okay so let's get a token I guess like that and then we don't need a token actually what am I doing we're gonna go log in right it's a local that's right I have to start that other one did I even start it I don't think I did have me here this is the auth server client oh client failed client ID uh that's because I changed it so the call to this yeah it's just client s great Okay so again make sure let's add um client ID wait all right I'm gonna clear this very good okay so that we didn't need to do that but it does prove that it works so now we go to localhost 882 and try that out uh one two seven zero one I mean and is that running yeah we need to yeah fingers crossed Secret so this will be a little interesting so now we have to kind of ask ourselves what is the username and password for this right if you go back to your uh authorization server I think you cleared the console but by default it's generating that password just like Spring Security and spring boot do for us oh in that case I'm just going to restart this thing what could go wrong um password so this is if this is because we didn't Define a uh authentication manager or something like that like right a user Detail Service we could set the password and properties if we wanted to the username is user in this case that's kind of the default uh right here yeah and there will be a couple things that we'll have to work through here because again if you remember we we were using 127001 for our host but I know you use localhost to to launch it so you might want to go back and and try that one more time 80 82 is right yep you're right it keeps forwarding me to localhost that's right so this is a redirect to the authorization server to log in yep so on off so why uh I want to log in why do I use this right so what what's happening now is that we're not logging in as our client we're logging in as ourselves so we're a user and so there needs to be some user that that can log in and so we just have one default user right now can I do a user detailed service the in memory one quick yes let's do it Okay so you could point this to your SQL database or whatever but right user Dot [Music] yeah uh username is best John wait what's it uh that's John R sure that one and j-o-h-n-r I think yeah there you go yeah yep then uh what is this collection of periodic array so either details start with uh with default password encoder build the name answer I'm I'm going to do this in production people this is just for it it's just it's obviously wrong I might do this Rod winch twice a little bit right thank you I have one job okay I don't know how to format that nicely do I need to do authorities I suppose I do huh uh I think you can get away without him but yeah you can certainly add a roll for each one if if we have to decide who's the admin and who's the regular user [Music] there you go that seemed like it would work I think so so least privilege first so j-long and PW 127.0.0.1 8082 login PW okay redirected back to this where there's no forward slash right uh can I uh so wait a minute what if I changed the resource server to just be forward slash so that way it actually or better yet how do I tell it to redirect oh no first let's just do that that's fine okay resource server and then go to the Gateway code and change that on the um all the client forward slash we'll go to that I guess I'm not sure if that'll work I should okay well yeah so now I've restarted everything I think 8082 brand new incognito browser I did already have the token I think we didn't restart the auth server but yeah let's do that okay go to the auth server start and go ahead and restart the client one more time too yeah get it fresh okay everything's brand new incognito mode localhost design 127.0.01 8082 and yeah yep okay and it's j o h n r and PW right hello oh that's okay so I want to point another thing out here so that felt a little too easy to you don't don't you feel like that was just too easy well yeah I mean look at me an hour still before the 15-minute Drive I was expecting this to take like you know come back tomorrow we'll finish it but no here we are one thing we haven't done yet is we haven't had our users actually consent to have their resources accessed right yeah okay so because we kind of adapted our registered client from the client credentials example in the blog post we didn't we didn't add that so we could require consent as part of this always a good idea let me do that in just half a second here um we're asking about the code and frankly I think that's a good idea which is stash our yeah okay um authorization server booty one uh that's weird Okay um public uh I'm taking your work and I'm going to make it open terms okay nice nice it's the best okay so code is that let's see I know it's time [Music] it's up everything for just a second okay I just want to make sure we have a checkpoint because it's already getting too good yeah checkpoint checkpoint can't you know can't have this go too quickly CD right slow it down Josh um downloads off off server do here copy R downloads off client to here our downloads for add okay um bus y not here right like go there okay people look you see are you not amused look at this amazing okay hold on let's exit that get rid of this okay look Steve this hurts me to do um I trust that everything I just did is successfully a backed up you know X of idea of clients from that great old idea uh off service yeah that's her oh that Gradle mm-hmm so where are we what is it's indexing thinking really hard cool nice wherever server you want to add that consent yep where do we so let's do that in Properties or in properties actually okay so we'll just need one additional property there um now it's it's underneath our our client so I think we called it client one and we'll add so like where you have authorization server.client.client one yep so we'll copy up to there and then we'll add require authorization consent is that it that's all I did all that work we could have done you're right we could have done that um I made this hard for no reason okay so off server go and then read their server go auth client go okay so now localhost I know one two seven zero zero one what is the meaning of it I don't know uh that's a great question 8082 thank you okay and s j o h n r and your password is definitely not PW but oh that's so cool it even looks good I'm sure the next the next thing is going to be like how do I style this and oh yeah okay so do I want to give the that that Steve Eisenberg guy seems like trouble but you know what we'll do it we'll go ahead and submit okay look at that that's so cool beautiful it is beautiful I can't believe that just all worked okay hold on let me see good status um and scent was fast [Music] so now I don't know yeah you want to try to grab him or where I think I think it's time yeah let's do it like look did you see that people I mean whatever it's just amazing here um let's just put this in are we still streaming you're still here it's got to be right here somewhere uh oh we got a good question here which is uh in some apps users do not have to consent but just access some resource that's fine too yeah that's what we did before right exactly before I added that one little property there's the code go get the code github.com coffee software show forward slash authorization hyphen server in boot three one okay uh and uh what I don't know that's it's just it's just magic trick that that happened today uh in a given Friday right yes I guess the jvm is now taking almost 500 Megs of memory on the authorization server you know look I dare you to do in 500 Megs or less what we just did any other way but nonetheless you're right we could make it better we could probably make it more efficient right so um gravia here we go off server I'm scared of this one like this one I have there's so many moving Parts you know in this thing all of which work by themselves out of the box with gravyam but I haven't really tried this do you think it's going to be okay have you tried this you know I have and it's it's it's great so do I wanna see don't I have enough CPU I've got like three how many weeks I've had like let's see what am I about this neck get get back here you stupid cursor keep pointing over to my uh my iPad 64 gigs that's just enough I can run slack and compile three gravity images all right so okay if we had four apps you might need more but yeah I think we're covered yeah okay I'm gonna stop this as well it'll go yeah native compile okay that's the off client we got the off server that just leaves a resource server stop this one as well okay great w ow made of compile did I remember to add Valium all of them I think you didn't for one of them it might be the resource server yes yeah okay so start oauth resource server lvm native image web I think we had web yeah so is this a mic for like uh officer resource server I gotta make sure I do that as well okay there we go yeah there may be one or two properties we'll need to add we'll give it a try but let's see I always have to try example where's our okay they're all still compiling I'm not hearing my fans oh wow one of them finished already the observer's already done that's the one I was most scared of you're saying that's just build Native Native pile of the f but the thing oh that's interesting it actually starts about as slow with Native as it does on the jvm oh is that because it's doing some sort of like cryptographic thing that's right so we're still using um some generated keys and I think we're we're generating some passwords that part will make it start slow and it takes a little bit of elbow grease to kind of move past that for sure okay so let's not okay so that's but it's it's not the startup time that's important here it's the memory and that's what I want to look at so let's grab that process identifier where's that thing where is it get over here there it is okay 7648 yes minus o r and s 97 makes yes yes so so it's starting up slow because it's generating it's using cryptography which takes time it's time bound um suitably unique uh key or two or three or whatever it's doing so that takes a little bit of time that's not a representation or a reflection of gravim or even Spring Security it's just Security in general any any technology would have that good and it's taking less than 100 Megs of ram to run this authorization server so you can manage and deploy active directory which is uh I guarantee you not kind of not going to fit in 100 Megs of ram um you kind of get slack to fit in 100 things around and uh and then this and then this is up and running so now what about the other ones this is the resource server okay so build native Native compile Resort server go so that started in 83 thousands of a second it's up and running again startup time though is not all that important what we care about here is the memory so High School rxs anything around thank you and then the off client how do we do that compiled as well build native Native compile off the client so I started up in 116 000 of a second but again not that important look at the process identifier where did I put it it 80 90 oh yeah 80 91 that's interesting that looks like a port right okay so yeah yes or says 80 [Music] yes please thank you so I guess do you think it'll work or is there something we might run into let's try it I think there might be one thing and I might know a way to get around it let's try it first so yeah okay and day long UW all right don't ask okay yes please submit hello it did just work okay well that's amazing I don't know what else there is to do Josh I think you got to go to the dentist now I was trying to delay as much as I can right yeah this is freaking amazing Steve thank you thank you thank you thank you thank you for having me who got something out of this this is like this is just that we even played music it's been a one hour and 11 minutes since we started this journey it's been fun it was a fun hour and 11 minutes for me and I think for the audience I think people will agree this is dope this is super cool um let me see here I'm gonna let me see how do I stop sharing my screen here stop screen there we go uh yeah this has been amazing maybe adapt my gravian request to dentist music yeah right um amazing just I'll check in all the code uh we didn't I don't think we did anything besides compile it uh you added you added a girl VM to your resource server that was about it yeah yeah and now so to the person complaining about the 500 Megs of memory for just one thing we're taking 300 Megs of memory for all three of them now right it's secure it's also fast it's nice when you can get functional and efficiency you know yeah have a good weekend everybody yeah thanks thanks my friend see you again see ya