Add OAuth2 feature for Config Clients #2363

cobar79 · 2023-12-07T15:53:23Z

When OAuth2 token property present, call IDP for Bearer Token.
Add Bearer Token header on config server resource requests.
Replace deprecated Base64Utils

When OAuth2 token property present, call IDP for Bearer Token. Add Bearer Token header on config server resource requests. gh-2348

- When OAuth2 token property present, Call IDP and obtain Bearer token. - Add Bearer token to config server requests. - Replaced deprecated Base64Utils. gh-2348

spencergibb · 2023-12-07T18:55:20Z

spring-cloud-config-client/pom.xml

@@ -21,6 +21,11 @@
    ]]>
 	</description>

+	<properties>
+		<jasypt-spring-boot.version>3.0.5</jasypt-spring-boot.version>
+		<okhttp.version>4.11.0</okhttp.version>


Can we use the boot-managed version?

@spencergibb
I attempted "boot managed" JCE but had problems with cipher in the client properties. There is so little information on JCE in a Spring Boot project and tons of examples for JASYPT that I went with the common encryption that was easier to set up and manage.

I can revisit it if I can get better documentation of getting it working the the config client.

client-secret: '{cipher}e4b1f56fb017319eb959595343d0e4f5a742e975860b723433f90e8f3e869a379db7c756e0537273aebf72cc3a4c3d48caf4955889c5e22be588523b0a88b5c8' Property: spring.cloud.config.client-secret Value: "{cipher}e4b1f56fb017319eb959595343d0e4f5a742e975860b723433f90e8f3e869a379db7c756e0537273aebf72cc3a4c3d48caf4955889c5e22be588523b0a88b5c8" Origin: URL [file:config/application-local.yml] - 73:22 Reason: java.lang.UnsupportedOperationException: No decryption for FailsafeTextEncryptor. Did you configure the keystore correctly?

what does that have to do with okhttp?

Mock server for IDP testing. See ConfigClientRequestTemplateFactoryTest

Ok, then back to my original comment, why can't the boot managed version of ok http be used?

Sorry, looking back I didn't specify okhttp as the one to boot manage.

Now that I am on the same page, I take "boot managed version of ok http" to be the org.springframework.test.web.client.MockRestServiceServer?

Since I have never used it, I may need help getting it to work. My first attempt failed with it timing out and not responding. My guess is because it has to be bound to the same RestTemplate making the call?
If so, that is going to be the chicken and the egg dilemma since I am testing the Factory method that creates the Template.

mockRestServiceServer = MockRestServiceServer.bindTo(new RestTemplate()).build(); mockRestServiceServer.expect(requestTo(new URI(properties.getTokenUri()))) .andExpect(method(HttpMethod.POST)) .andExpect(content().contentType(MediaType.APPLICATION_FORM_URLENCODED)) .andRespond(withStatus(HttpStatus.OK) .contentType(MediaType.APPLICATION_JSON) .body(TOKEN_RESPONSE));

Nope https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/3.2.0/spring-boot-dependencies-3.2.0.pom

<okhttp.version>4.12.0</okhttp.version>

You should just be able to remove the version property and the version tag.

Done. Did not know it was included. Will have to update all my microservices.

It didn't used to be, it was added at some point. We had the same thing in spring cloud

ryanjbaxter · 2023-12-11T21:09:17Z

...fig-client/src/main/java/org/springframework/cloud/config/client/ConfigClientProperties.java

@@ -117,6 +117,47 @@ public class ConfigClientProperties {
 	 */
 	private String password;

+	/**


Might be cleaner to place these properties in a subclass called oauth2 so we would use spring.cloud.config.oauth2.*

Done. See ConfigClientOauth2Properties

ryanjbaxter · 2023-12-11T21:10:36Z

...rc/main/java/org/springframework/cloud/config/client/ConfigClientRequestTemplateFactory.java

@@ -67,6 +82,17 @@ public ConfigClientProperties getProperties() {
 		return this.properties;
 	}

+	public SimplePBEByteEncryptor buildEncryptor() {


This should probably be some kind of bean that the user can override

Done. I embedded it into the ConfigClientProperties. It got real messy trying to pass it into the pass additional configurations into the ConfigClientRequestTemplateFactory constructor.

ryanjbaxter · 2023-12-11T21:13:15Z

...ient/src/main/java/org/springframework/cloud/config/client/ConfigServerConfigDataLoader.java

+					restTemplate.setInterceptors(interceptors);
+				}
+				else {
+					requestTemplateFactory.addAuthorizationToken(headers, username, password);


What happens if this token expires?

In general, the Spring Security Framework handles refreshing of the token. I am still trying to set up a test for the actuator monitor endpoint to see if the security framework will append the token to the config server request to pull new updates. In theory it should work since the Spring Context is fully boot strapped.

OK please let us know when you have tested that

Sorry for the redaction. I was looking at postman response and failed to review the client logs.

09:40:07.119 [http-nio-9440-exec-8] WARN o.s.c.c.c.ConfigServerConfigDataLoader - Could not locate PropertySource ([ConfigServerConfigDataResource@6cca236b uris = array<String>['http://localhost:8888/config-server'], optional = true, profiles = 'local']): 401 : "{"path":"/config-server/gdelt-ingest/local","message":"An error occurred while attempting to decode the Jwt: Jwt expired at 2023-12-19T15:50:42Z","propertyPath":null,"propertyValue":null,"timestamp":"2023-12-19 09:40:07.086-07"}"

@ryanjbaxter @spencergibb
Is it ok to bring in a JWT Decoder to check expiration?

<dependency> <groupId>com.auth0</groupId> <artifactId>java-jwt</artifactId> <version>4.4.0</version> </dependency>

…rties

...ient/src/main/java/org/springframework/cloud/config/client/ConfigClientOauth2Properties.java

ryanjbaxter · 2023-12-18T21:17:32Z

...ient/src/main/java/org/springframework/cloud/config/client/ConfigServerConfigDataLoader.java

+					restTemplate.setInterceptors(interceptors);
+				}
+				else {
+					requestTemplateFactory.addAuthorizationToken(headers, username, password);


OK please let us know when you have tested that

ryanjbaxter · 2023-12-18T21:37:26Z

We will also need to add some documentation for this

cobar79 · 2023-12-19T16:30:17Z

@ryanjbaxter Can you point me to the repo that contains the Spring Cloud Config that I will need to update?

spencergibb · 2023-12-19T16:31:35Z

Docs live here https://github.com/spring-cloud/spring-cloud-config/tree/main/docs/modules/ROOT/pages

cobar79 · 2023-12-20T12:30:32Z

Docs live here https://github.com/spring-cloud/spring-cloud-config/tree/main/docs/modules/ROOT/pages

Nervous that I didn't fork correctly. I am in the 4.0.5-SNAPSHOT and I do not see the modules directory under the docs module?
I only see src/main/asciidoc folder?

Also curious how this will go since I see a 4.1.0 release of spring-cloud-starter-config on Dec 6th in Maven Central?

ryanjbaxter · 2023-12-20T19:58:52Z

Yes this will actually have to go in a feature release, most likely 4.2.x. That said its best to use main.

cobar79 · 2023-12-21T12:56:12Z

Thanks @ryanjbaxter
Sorry, I am very new to the forking to another repo and merging back.

Can I sync the current fork in my repo or do I need to:

Close this PR
Delete the fork in my repo
Create a new fork into my repo from main which shows 4.1.1-SNAPSHOT.
Create the feature branch off main in my repo.
Move code to new fork.
Then cut new PR back into main on this repo.

ryanjbaxter · 2023-12-21T14:03:18Z

Yes I think so

cobar79 · 2023-12-22T13:16:07Z

Moving to version 4.1

spring-builds and others added 3 commits November 30, 2023 13:48

Bumping versions

4064b79

Add OAuth2 feature for config clients

840d70b

When OAuth2 token property present, call IDP for Bearer Token. Add Bearer Token header on config server resource requests. gh-2348

Add OAuth2 feature for config clients

d7a0f24

- When OAuth2 token property present, Call IDP and obtain Bearer token. - Add Bearer token to config server requests. - Replaced deprecated Base64Utils. gh-2348

spring-cloud-issues added the waiting-for-triage label Dec 7, 2023

cobar79 mentioned this pull request Dec 7, 2023

Provide support for OAuth2 in Spring Config Client. #2348

Open

spencergibb reviewed Dec 7, 2023

View reviewed changes

Use Boot okhttp bom version

24e1e27

ryanjbaxter reviewed Dec 11, 2023

View reviewed changes

ryanjbaxter requested changes Dec 11, 2023

View reviewed changes

ryanjbaxter added waiting for feedback and removed waiting-for-triage labels Dec 11, 2023

ryanjbaxter linked an issue Dec 11, 2023 that may be closed by this pull request

Provide support for OAuth2 in Spring Config Client. #2348

Open

Bruce Randall added 2 commits December 14, 2023 16:53

PR resolution

eb89313

move decryption logic to Encryptor Config. handle no encryption prope…

7b498b2

…rties

ryanjbaxter reviewed Dec 18, 2023

View reviewed changes

spencergibb added the enhancement label Dec 18, 2023

Bruce Randall added 2 commits December 19, 2023 08:32

OAuth property rename

2bbf465

Fix code smell

a9f768e

cobar79 closed this Dec 22, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add OAuth2 feature for Config Clients #2363

Add OAuth2 feature for Config Clients #2363

cobar79 commented Dec 7, 2023

spencergibb Dec 7, 2023

cobar79 Dec 7, 2023

spencergibb Dec 7, 2023

cobar79 Dec 7, 2023

spencergibb Dec 8, 2023

spencergibb Dec 8, 2023

cobar79 Dec 8, 2023

spencergibb Dec 8, 2023

cobar79 Dec 8, 2023

spencergibb Dec 8, 2023

ryanjbaxter Dec 11, 2023

cobar79 Dec 14, 2023

ryanjbaxter Dec 11, 2023

cobar79 Dec 15, 2023

ryanjbaxter Dec 11, 2023

cobar79 Dec 15, 2023

ryanjbaxter Dec 18, 2023

cobar79 Dec 19, 2023 •

edited

cobar79 Dec 20, 2023 •

edited

ryanjbaxter Dec 18, 2023

ryanjbaxter commented Dec 18, 2023

cobar79 commented Dec 19, 2023

spencergibb commented Dec 19, 2023

cobar79 commented Dec 20, 2023

ryanjbaxter commented Dec 20, 2023

cobar79 commented Dec 21, 2023

ryanjbaxter commented Dec 21, 2023

cobar79 commented Dec 22, 2023

Add OAuth2 feature for Config Clients #2363

Add OAuth2 feature for Config Clients #2363

Conversation

cobar79 commented Dec 7, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cobar79 Dec 19, 2023 • edited

Choose a reason for hiding this comment

cobar79 Dec 20, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ryanjbaxter commented Dec 18, 2023

cobar79 commented Dec 19, 2023

spencergibb commented Dec 19, 2023

cobar79 commented Dec 20, 2023

ryanjbaxter commented Dec 20, 2023

cobar79 commented Dec 21, 2023

ryanjbaxter commented Dec 21, 2023

cobar79 commented Dec 22, 2023

cobar79 Dec 19, 2023 •

edited

cobar79 Dec 20, 2023 •

edited