Subject (formerly "on behalf of") tokens #585
Description
I need to secure a couple of rest services and I'm using Spring Boot (along with Spring Security) and Spring Security OAuth. These services belong to a resource server and they assume that the users making the request are already authenticated, so they only verify the token's validity and the authorities to see if the users have the proper authorization to the service that they're calling.
I also have "on behalf of" tokens, as specified here: https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-02#section-2.2
I didn't find a way to verify these "on behalf of" tokens in Spring Security OAuth, so I did the following: I created a custom class that extends JwtAccessTokenConverter. Here I overloaded the decode() method as follows:
@Override
protected Map<String, Object> decode(String token) {
Map<String, Object> decodedToken = super.decode(token);
Map<String, Object> result = new HashMap<>(decodedToken);
if (decodedToken.containsKey("on_behalf_of")) {
// this token is an "on behalf of" token
String representedUserToken = (String) decodedToken.get("on_behalf_of");
result = super.decode(representedUserToken);
}
return result;
}Finally I added this custom class to the ResourceServerSecurityConfigurer as follows:
@Override
public void configure(ResourceServerSecurityConfigurer resourceServerSecurityConfigurer) throws Exception {
CustomJwtAccessTokenConverter jwtTokenEnhancer = new CustomJwtAccessTokenConverter();
resourceServerSecurityConfigurer.tokenStore(new JwtTokenStore(jwtTokenEnhancer));
}I was wondering if there's a better way to archieve this, being able to validate and authorize an "on behalf of" token, so the final security context has the scopes of the represented user.
Thanks in advance!!