mb-spring-security's Introduction

Spring Security OAuth Client / Resource Server Showcase

This project houses an example resource server and a matching client, both are spring boot web applications.

The only thing not included is an authentication server.

I used a locally running standalone keycloak for that.

test urls

App	Url	Purpose
Resource Server	http://localhost:8082/transactions	some test data (fake financial transactions)
Client	http://localhost:8081/remote	makes to call to the resource server's transactions endpoint
Client	http://localhost:8081/client	some debug client info fetched out of the currently active authentication
Client	http://localhost:8081/local	is not supposed to call the resource server therefore this endpoint should work without any login

get the zip distribution and run it standalone.bat / standalone.sh
go to http://localhost:8080/auth
create an admin user
create a new domain called Dev (or any name you like)
create a new client called mb-client (or any name you like) that uses "openid-connect" protocol
note down the client credentials (client-secret)
add a new user with some basic user info and set a password for that user
add a new client scope read_transactions
add a mapper to this scope to provide a hardcoded jwt claim "account_no" with a dummy value
add the new scope to the optional scopes available for the client mb-client

Recommend Projects