How to configure resource server with custom auth server for token - spring-security

Question

I am trying to configure resource server with my spring boot kotlin project, basically i have a bearer token which is opaque token i pass it to my rest controller which comes from mobile app and on my server side i need to authenticate along with custom authorization server(opaquetoken) with url https://**.com/oauth2/token
My current configuration is as below
application.yml
spring:
security:
oauth2:
resourceserver:
opaquetoken:
introspection-uri: https://****/oauth2/introspect
client-id: XXXX
client-secret: XXXX
and:
sample code as below
#SpringBootApplication
class DemoApplication
#RestController
class HelloController {
#GetMapping("/hello")
fun hello(#AuthenticationPrincipal principal: OAuth2AuthenticatedPrincipal) = "hello ${principal.getAttribute<Any>("sub")}"
#GetMapping("/hello2")
fun hello2() = "hello2"
}
#Configuration
class WebSecurityConfigurerAdapter2 : WebSecurityConfigurerAdapter() {
#Value("\${spring.security.oauth2.resourceserver.opaque.introspection-uri}")
var introspectionUri: String? = null
#Value("\${spring.security.oauth2.resourceserver.opaque.client-id}")
var clientId: String? = null
#Value("\${spring.security.oauth2.resourceserver.opaque.client-secret}")
var clientSecret: String? = null
#Throws(Exception::class)
override fun configure(http: HttpSecurity) {
http
.authorizeRequests { authz ->
authz
.antMatchers("/hello")
.authenticated()
}
.oauth2ResourceServer { oauth2: OAuth2ResourceServerConfigurer<HttpSecurity?> ->
oauth2
.opaqueToken { token ->
val resourceDetails = ClientCredentialsResourceDetails()
resourceDetails.accessTokenUri = "https://****/oauth2/token"
resourceDetails.clientId = clientId
resourceDetails.clientSecret = clientSecret
resourceDetails.scope = listOf("***")
val restTemplate = OAuth2RestTemplate(resourceDetails)
token.introspector(NimbusOpaqueTokenIntrospector(introspectionUri, restTemplate))
}
}
}
}
fun main(args: Array<String>) {
runApplication<DemoApplication>(*args)
}
Everything works fine and i am able to get principal object after i make a call with bearer token to GET http://localhost:8080/hello with Authorization Bearer but i see ClientCredentialsResourceDetails and OAuth2RestTemplate are deprecated, is there any latest document or sample code for this custom auth server and introspect for rest.
Appreciate help and suggestions!
Issue is solved -
and:
sample code as below
#Component
class CustomRequestEntityConverter(
#Value("${spring.security.oauth2.resourceserver.opaquetoken.access-token-uri}") val accessTokenUri: URI,
val properties: OAuth2ResourceServerProperties
) :
Converter<String, RequestEntity<*>> {
private val restTemplate = RestTemplate()
override fun convert(token: String): RequestEntity<*>? {
val headers: HttpHeaders = requestHeaders(authToken())
val body: MultiValueMap<String, String> = requestBody(token)
return RequestEntity(
body,
headers,
HttpMethod.POST,
URI.create(properties.opaquetoken.introspectionUri)
)
}
/**
* Obtains auth-token from the Authentication server using client-credentials flow.
*/
private fun authToken(): String {
val headers = HttpHeaders()
headers.setBasicAuth(properties.opaquetoken.clientId, properties.opaquetoken.clientSecret)
headers.contentType = MediaType.APPLICATION_FORM_URLENCODED
val bodyParamMap = LinkedMultiValueMap<String, String>()
bodyParamMap.add("grant_type", "client_credentials");
val entity = HttpEntity<MultiValueMap<String, String>>(bodyParamMap, headers)
return restTemplate.postForObject(accessTokenUri, entity, JsonNode::class.java)
?.get("access_token")?.asText()
?: throw RuntimeException("Failed to retrieve access token from authentication server")
}
private fun requestHeaders(bearerToken: String): HttpHeaders {
val headers = HttpHeaders()
headers.setBearerAuth(bearerToken)
headers.accept = listOf(MediaType.APPLICATION_JSON)
return headers
}
private fun requestBody(token: String): MultiValueMap<String, String> {
val body: MultiValueMap<String, String> = LinkedMultiValueMap()
body.add("token", token)
return body
}
}
#Configuration
class WebSecurityConfigurerAdapter2 : WebSecurityConfigurerAdapter() {
#Bean
fun opaqueTokenIntrospector(
properties: OAuth2ResourceServerProperties,
conv: CustomRequestEntityConverter
): NimbusOpaqueTokenIntrospector {
val introspector = NimbusOpaqueTokenIntrospector(
properties.opaquetoken.introspectionUri,
properties.opaquetoken.clientId,
properties.opaquetoken.clientSecret
)
introspector.setRequestEntityConverter(conv)
return introspector
}
override fun configure(http: HttpSecurity) {
http
.authorizeRequests { authz ->
authz
.antMatchers("/hello")
.authenticated()
}
.oauth2ResourceServer {
it
.opaqueToken()
}
}
}