[Advanced Spring Boot] OAuth2 và OpenID Connect trong Spring Boot: OAuth2 Login và resource server với JWT

curl -s "https://start.spring.io/starter.zip?type=gradle-project&language=java&bootVersion=4.1.1&javaVersion=21&groupId=com.example&artifactId=web&name=web&packageName=com.example.web&dependencies=web,security,oauth2-client" -o web.zip
curl -s "https://start.spring.io/starter.zip?type=gradle-project&language=java&bootVersion=4.1.1&javaVersion=21&groupId=com.example&artifactId=api&name=api&packageName=com.example.api&dependencies=web,security,oauth2-resource-server" -o api.zip

curl -s https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-starter-oauth2-client/4.1.1/spring-boot-starter-oauth2-client-4.1.1.pom | grep '<description>'

  <description>Starter for using Spring Security's OAuth2/OpenID Connect client features (deprecated in favor of spring-boot-starter-security-oauth2-client)</description>

{
  "realm": "catalogue",
  "enabled": true,
  "roles": {
    "realm": [ { "name": "ADMIN", "description": "Catalogue administrator" } ]
  },
  "users": [
    {
      "id": "0140b1ce-67b1-432d-af8e-f021ea7cea40",
      "username": "alice",
      "enabled": true,
      "email": "alice@example.com",
      "emailVerified": true,
      "firstName": "Alice",
      "lastName": "Liddell",
      "credentials": [ { "type": "password", "value": "Wonderland-2026", "temporary": false } ]
    },
    {
      "id": "dfc3c0df-f01c-43c3-a4a5-a212699bbe09",
      "username": "bob",
      "enabled": true,
      "email": "bob@example.com",
      "emailVerified": true,
      "firstName": "Bob",
      "lastName": "Builder",
      "credentials": [ { "type": "password", "value": "Builder-2026", "temporary": false } ],
      "realmRoles": [ "ADMIN" ]
    }
  ],
  "clients": [
    {
      "clientId": "web-client",
      "secret": "web-client-secret",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [ "http://localhost:8213/login/oauth2/code/keycloak" ],
      "attributes": { "post.logout.redirect.uris": "http://localhost:8213/" },
      "protocolMappers": [
        {
          "name": "catalogue-api audience",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-audience-mapper",
          "config": { "included.custom.audience": "catalogue-api", "access.token.claim": "true" }
        }
      ]
    },
    {
      "clientId": "reporting-service",
      "secret": "reporting-service-secret",
      "publicClient": false,
      "standardFlowEnabled": false,
      "serviceAccountsEnabled": true,
      "protocolMappers": [
        {
          "name": "catalogue-api audience",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-audience-mapper",
          "config": { "included.custom.audience": "catalogue-api", "access.token.claim": "true" }
        }
      ]
    },
    {
      "clientId": "partner-service",
      "secret": "partner-service-secret",
      "publicClient": false,
      "standardFlowEnabled": false,
      "serviceAccountsEnabled": true
    }
  ]
}

{
  "realm": "other",
  "enabled": true,
  "clients": [
    {
      "clientId": "reporting-service",
      "secret": "reporting-service-secret",
      "publicClient": false,
      "standardFlowEnabled": false,
      "serviceAccountsEnabled": true,
      "protocolMappers": [
        {
          "name": "catalogue-api audience",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-audience-mapper",
          "config": { "included.custom.audience": "catalogue-api", "access.token.claim": "true" }
        }
      ]
    }
  ]
}

docker run -d --name sba-a13-keycloak --memory 1536m -p 8313:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
  -v "$PWD/keycloak:/opt/keycloak/data/import:ro" \
  quay.io/keycloak/keycloak:26.7.4 start-dev --import-realm --http-access-log-enabled=true

INFO  [org.keycloak.exportimport.dir.DirImportProvider] (main) Importing from directory /opt/keycloak/bin/../data/import
INFO  [org.keycloak.exportimport.util.ImportUtils] (main) Realm 'catalogue' imported
INFO  [org.keycloak.exportimport.util.ImportUtils] (main) Realm 'other' imported
INFO  [org.keycloak.services] (main) KC-SERVICES0032: Import finished successfully
INFO  [io.quarkus] (main) Keycloak 26.7.4 on JVM (powered by Quarkus 3.33.3.2) started in 6.414s. Listening on: http://0.0.0.0:8080

curl -s http://localhost:8313/realms/catalogue/.well-known/openid-configuration | jq '{issuer, authorization_endpoint, token_endpoint, userinfo_endpoint, end_session_endpoint, jwks_uri, grant_types_supported, code_challenge_methods_supported}'

{
  "issuer": "http://localhost:8313/realms/catalogue",
  "authorization_endpoint": "http://localhost:8313/realms/catalogue/protocol/openid-connect/auth",
  "token_endpoint": "http://localhost:8313/realms/catalogue/protocol/openid-connect/token",
  "userinfo_endpoint": "http://localhost:8313/realms/catalogue/protocol/openid-connect/userinfo",
  "end_session_endpoint": "http://localhost:8313/realms/catalogue/protocol/openid-connect/logout",
  "jwks_uri": "http://localhost:8313/realms/catalogue/protocol/openid-connect/certs",
  "grant_types_supported": [
    "authorization_code",
    "client_credentials",
    "implicit",
    "password",
    "refresh_token",
    "urn:ietf:params:oauth:grant-type:device_code",
    "urn:ietf:params:oauth:grant-type:jwt-bearer",
    "urn:ietf:params:oauth:grant-type:token-exchange",
    "urn:ietf:params:oauth:grant-type:uma-ticket",
    "urn:openid:params:grant-type:ciba"
  ],
  "code_challenge_methods_supported": [
    "plain",
    "S256"
  ]
}

package com.example.web.security;
 
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
 
@Configuration
public class SecurityConfig {
 
    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) {
        http
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/").permitAll()
                        .requestMatchers("/admin/**").hasRole("ADMIN")
                        .anyRequest().authenticated())
                .oauth2Login(Customizer.withDefaults());
        return http.build();
    }
}

package com.example.web.account;
 
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.core.oidc.user.OidcUser;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
 
@RestController
public class AccountController {
 
    @GetMapping("/")
    public String home() {
        return "Catalogue web client";
    }
 
    @GetMapping("/me")
    public AccountResponse me(@AuthenticationPrincipal OidcUser user, Authentication authentication) {
        return new AccountResponse(
                user.getClass().getSimpleName(),
                authentication.getName(),
                user.getClaims(),
                authentication.getAuthorities().stream().map(GrantedAuthority::getAuthority).toList());
    }
 
    @GetMapping("/admin")
    public String admin(Authentication authentication) {
        return "Admin area for " + authentication.getName();
    }
}

package com.example.web.account;
 
import java.util.List;
import java.util.Map;
 
public record AccountResponse(String principal, String name, Map<String, Object> claims, List<String> authorities) {
}

DefaultSecurityFilterChain: Will secure any request with filters: DisableEncodeUrlFilter, WebAsyncManagerIntegrationFilter, SecurityContextHolderFilter, HeaderWriterFilter, CsrfFilter, LogoutFilter, OAuth2AuthorizationRequestRedirectFilter, OAuth2LoginAuthenticationFilter, DefaultResourcesFilter, DefaultLoginPageGeneratingFilter, DefaultLogoutPageGeneratingFilter, RequestCacheAwareFilter, SecurityContextHolderAwareRequestFilter, AnonymousAuthenticationFilter, ExceptionTranslationFilter, AuthorizationFilter

"GET /realms/catalogue/.well-known/openid-configuration HTTP/1.1" 200 6628

Caused by: java.lang.IllegalArgumentException: Unable to resolve Configuration with the provided Issuer of "http://localhost:8313/realms/catalogue"
Caused by: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "http://localhost:8313/realms/catalogue/.well-known/openid-configuration": Connection refused
Caused by: java.net.ConnectException: Connection refused

#!/bin/zsh
# usage: flow.sh <username> <password> <dir>
# The OAuth2 login of the web client, driven with curl one hop at a time; every response is saved.
USER_NAME=$1; PASSWORD=$2; DIR=$3
mkdir -p $DIR; JAR=$DIR/jar; rm -f $JAR
loc() { grep -i '^Location:' $1 | sed 's/^Location: //I' | tr -d '\r'; }
curl -s -i -c $JAR -b $JAR http://localhost:8213/me > $DIR/1-me.txt
curl -s -i -c $JAR -b $JAR "$(loc $DIR/1-me.txt)" > $DIR/2-authorization.txt
curl -s -i -c $JAR -b $JAR "$(loc $DIR/2-authorization.txt)" > $DIR/3-keycloak-login-page.txt
ACTION=$(grep -o 'action="[^"]*"' $DIR/3-keycloak-login-page.txt | head -1 | sed 's/action="//; s/"$//; s/&amp;/\&/g')
curl -s -i -c $JAR -b $JAR --data-urlencode "username=$USER_NAME" --data-urlencode "password=$PASSWORD" \
  --data-urlencode credentialId= "$ACTION" > $DIR/4-keycloak-login-post.txt
curl -s -i -c $JAR -b $JAR "$(loc $DIR/4-keycloak-login-post.txt)" > $DIR/5-callback.txt
curl -s -i -c $JAR -b $JAR "$(loc $DIR/5-callback.txt)" > $DIR/6-me.txt
for f in $DIR/[1-6]-*.txt; do echo "$(basename $f): $(head -1 $f | tr -d '\r') $(loc $f | cut -c1-120)"; done

./flow.sh alice Wonderland-2026 out/flow

HTTP/1.1 302
Set-Cookie: JSESSIONID=98FDE59B4FF470163378DA265D1D9CDF; Path=/; HttpOnly
Location: http://localhost:8213/oauth2/authorization/keycloak

HTTP/1.1 302
Location: http://localhost:8313/realms/catalogue/protocol/openid-connect/auth?response_type=code&client_id=web-client&scope=openid%20profile%20email&state=-F09KmWBnUjvu5nRLnx0OECqanJf95azinS4-aRyql0%3D&redirect_uri=http://localhost:8213/login/oauth2/code/keycloak&nonce=qXI1MCVMcR2tIqxkQqKGqelhbfv6ieuZhwMLPEx8jQ0&code_challenge=8UTXb4PtdQDFCF9k8YRjo1TkYa_TIBq34Xgcb2aZ82Y&code_challenge_method=S256

http://localhost:8313/realms/catalogue/login-actions/authenticate?session_code=0pbpKaQoaj15n8Vo-x0VKkUFMiWP2qcvcxQdGN2yVjY&execution=d3cc8a17-39aa-4282-b845-7ce18fae3084&client_id=web-client&tab_id=2QxW60S8ymE&client_data=eyJydSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODIxMy9sb2dpbi9vYXV0aDIvY29kZS9rZXljbG9hayIsInJ0IjoiY29kZSIsInN0IjoiLUYwOUttV0JuVWp2dTVuUkxueDBPRUNxYW5KZjk1YXppblM0LWFSeXFsMD0ifQ

HTTP/1.1 302 Found
Set-Cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI2NmM4YjlmZC0wZTliLTQxZWQtOGZjMy03MjllYWZiMzY3MDYifQ…;Version=1;Path=/realms/catalogue/;Secure;HttpOnly;SameSite=None
Set-Cookie: KEYCLOAK_SESSION=9WKq1MeUcea8kHBNYkf1-ZMaZLwSjOlwTHYN5jTpP6t5u3-BqWzqwqzV7v2tISM9;Version=1;Path=/realms/catalogue/;Max-Age=36000;Secure;SameSite=None
Location: http://localhost:8213/login/oauth2/code/keycloak?state=-F09KmWBnUjvu5nRLnx0OECqanJf95azinS4-aRyql0%3D&session_state=GZM2n7fhTBuMOXZ38iSLEVWW&iss=http%3A%2F%2Flocalhost%3A8313%2Frealms%2Fcatalogue&code=b1d8170d-d742-9150-c542-f4df81d6c986.GZM2n7fhTBuMOXZ38iSLEVWW.09c03f81-03c2-48d1-8478-b40f62afe290

HTTP/1.1 302
Set-Cookie: JSESSIONID=DBD16E3F828AA2D5C590FD0D9FABF48C; Path=/; HttpOnly
Location: http://localhost:8213/me?continue

"POST /realms/catalogue/protocol/openid-connect/token HTTP/2" 200 -
"GET /realms/catalogue/protocol/openid-connect/certs HTTP/1.1" 200 2933
"GET /realms/catalogue/protocol/openid-connect/userinfo HTTP/1.1" 200 193

curl -s -i -u web-client:web-client-secret -d grant_type=authorization_code -d "code=$CODE" \
  -d redirect_uri=http://localhost:8213/login/oauth2/code/keycloak \
  http://localhost:8313/realms/catalogue/protocol/openid-connect/token

HTTP/1.1 400 Bad Request
 
{"error":"invalid_grant","error_description":"PKCE code verifier not specified"}

package com.example.web.lab;
 
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.ResponseEntity;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.annotation.RegisteredOAuth2AuthorizedClient;
import org.springframework.security.oauth2.core.oidc.user.OidcUser;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
 
// Lab only: writes the tokens to the server log so they can be decoded; never ship this.
@RestController
public class TokenLogController {
 
    private static final Logger log = LoggerFactory.getLogger(TokenLogController.class);
 
    @GetMapping("/lab/tokens")
    public ResponseEntity<Void> logTokens(@AuthenticationPrincipal OidcUser user,
                                          @RegisteredOAuth2AuthorizedClient("keycloak") OAuth2AuthorizedClient client) {
        log.info("id_token={}", user.getIdToken().getTokenValue());
        log.info("access_token={}", client.getAccessToken().getTokenValue());
        log.info("access_token scopes={} expiresAt={} refresh_token={}", client.getAccessToken().getScopes(),
                client.getAccessToken().getExpiresAt(), client.getRefreshToken() != null);
        return ResponseEntity.noContent().build();
    }
}

grep '^TokenLogController: id_token=' web.log | tail -1 | sed 's/.*id_token=//' > id.jwt
grep '^TokenLogController: access_token=' web.log | tail -1 | sed 's/.*access_token=//' > access.jwt
cut -d. -f2 < id.jwt | b64url_decode | jq .
cut -d. -f2 < access.jwt | b64url_decode | jq .

{
  "exp": 1789716040,
  "iat": 1789715740,
  "auth_time": 1789715740,
  "jti": "fb265f05-d6dd-ef7e-7532-b84527f66e25",
  "iss": "http://localhost:8313/realms/catalogue",
  "aud": "web-client",
  "sub": "dfc3c0df-f01c-43c3-a4a5-a212699bbe09",
  "typ": "ID",
  "azp": "web-client",
  "nonce": "-yGkh_CcVGywOUJz5RsmkyQfCtKGKgzpWvjseQRKpcY",
  "sid": "2iMZty-p32L9z9UcttfQX67X",
  "at_hash": "wfQkTQ1piUYK3urueWKUEA",
  "acr": "1",
  "email_verified": true,
  "name": "Bob Builder",
  "preferred_username": "bob",
  "given_name": "Bob",
  "family_name": "Builder",
  "email": "bob@example.com"
}

{
  "exp": 1789716040,
  "iat": 1789715740,
  "auth_time": 1789715740,
  "jti": "onrtac:1d07b246-2e7d-a7d6-7f5b-ce6996036943",
  "iss": "http://localhost:8313/realms/catalogue",
  "aud": "catalogue-api",
  "sub": "dfc3c0df-f01c-43c3-a4a5-a212699bbe09",
  "typ": "Bearer",
  "azp": "web-client",
  "sid": "2iMZty-p32L9z9UcttfQX67X",
  "acr": "1",
  "allowed-origins": [
    "http://localhost:8213"
  ],
  "realm_access": {
    "roles": [
      "ADMIN"
    ]
  },
  "scope": "openid email profile",
  "email_verified": true,
  "name": "Bob Builder",
  "preferred_username": "bob",
  "given_name": "Bob",
  "family_name": "Builder",
  "email": "bob@example.com"
}

printf '%s' "$(cat access.jwt)" | openssl dgst -sha256 -binary | head -c 16 | b64url

wfQkTQ1piUYK3urueWKUEA

{"principal":"DefaultOidcUser","name":"0140b1ce-67b1-432d-af8e-f021ea7cea40","claims":{"at_hash":"rMSmeXcXb14YU7G0bbxvZA","sub":"0140b1ce-67b1-432d-af8e-f021ea7cea40","email_verified":true,"iss":"http://localhost:8313/realms/catalogue","typ":"ID","preferred_username":"alice","given_name":"Alice","nonce":"ahg0n9AdRAuB9PzVmKdYHsHmr_YGuEwCKw8CJSvGAXA","sid":"jH_TrllUcP-XTZ5tYMb0K6go","aud":["web-client"],"acr":"1","azp":"web-client","auth_time":"2026-09-18T07:12:24Z","name":"Alice Liddell","exp":"2026-09-18T07:17:30Z","family_name":"Liddell","iat":"2026-09-18T07:12:30Z","email":"alice@example.com","jti":"5192ca65-4557-5820-f76b-4f22cc457480"},"authorities":["OIDC_USER","SCOPE_email","SCOPE_openid","SCOPE_profile"]}

curl -s -i -b out/flow-bob/jar http://localhost:8213/admin

HTTP/1.1 403
Content-Type: application/json
 
{"timestamp":"2026-09-18T07:15:40.195Z","status":403,"error":"Forbidden","path":"/admin"}

import java.util.Collection; 
import java.util.HashSet; 
import java.util.Map; 
import java.util.Set; 
 
import org.springframework.security.core.GrantedAuthority; 
import org.springframework.security.core.authority.SimpleGrantedAuthority; 
import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper; 
import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority; 
 
    @Bean
    GrantedAuthoritiesMapper keycloakRealmRolesMapper() { 
        return authorities -> { 
            Set<GrantedAuthority> mapped = new HashSet<>(authorities); 
            for (GrantedAuthority authority : authorities) { 
                if (authority instanceof OidcUserAuthority oidc 
                        && oidc.getIdToken().getClaim("realm_access") instanceof Map<?, ?> realmAccess 
                        && realmAccess.get("roles") instanceof Collection<?> roles) { 
                    roles.forEach(role -> mapped.add(new SimpleGrantedAuthority("ROLE_" + role))); 
                } 
            } 
            return mapped; 
        }; 
    } 

      "protocolMappers": [
        {
          "name": "catalogue-api audience",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-audience-mapper",
          "config": { "included.custom.audience": "catalogue-api", "access.token.claim": "true" }
        }, 
        { 
          "name": "realm roles in ID token", 
          "protocol": "openid-connect", 
          "protocolMapper": "oidc-usermodel-realm-role-mapper", 
          "config": { "claim.name": "realm_access.roles", "multivalued": "true", "id.token.claim": "true", "access.token.claim": "false" } 
        }
      ]

./flow.sh bob Builder-2026 out/flow-bob
tail -1 out/flow-bob/6-me.txt | jq -c '{name, authorities, realm: .claims.realm_access}'
curl -s -i -b out/flow-bob/jar http://localhost:8213/admin

{"name":"bob","authorities":["SCOPE_openid","SCOPE_email","ROLE_ADMIN","SCOPE_profile","OIDC_USER"],"realm":{"roles":["ADMIN"]}}
HTTP/1.1 200
Admin area for bob

CSRF=$(curl -s -b jar -c jar http://localhost:8213/logout | grep -o 'name="_csrf" type="hidden" value="[^"]*"' | sed 's/.*value="//; s/"$//')
curl -s -i -b jar -c jar -d "_csrf=$CSRF" http://localhost:8213/logout

HTTP/1.1 302
Location: http://localhost:8213/login?logout

2-me.txt: HTTP/1.1 302  -> http://localhost:8213/oauth2/authorization/keycloak
3-authz.txt: HTTP/1.1 302  -> http://localhost:8313/realms/catalogue/protocol/openid-connect/auth?response_type=code&client_id=web-client&scope=openid%20profile%20email&state=pA-Vk
4-keycloak.txt: HTTP/1.1 302 Found -> http://localhost:8213/login/oauth2/code/keycloak?state=pA-Vkm3pZgxHJWVvDSZ9XBvfdcbbPD_7j0XyFWXstjA%3D&session_state=FAO9KxHtxRhvyFYj_6HgCEg6&iss=http%
5-callback.txt: HTTP/1.1 302  -> http://localhost:8213/me?continue
6-me.txt: HTTP/1.1 200  ->

import org.springframework.security.oauth2.client.oidc.web.logout.OidcClientInitiatedLogoutSuccessHandler; 
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository; 
 
    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) { 
    SecurityFilterChain securityFilterChain(HttpSecurity http, ClientRegistrationRepository clientRegistrations) { 
        OidcClientInitiatedLogoutSuccessHandler logoutSuccessHandler = 
                new OidcClientInitiatedLogoutSuccessHandler(clientRegistrations); 
        logoutSuccessHandler.setPostLogoutRedirectUri("{baseUrl}/"); 
        http
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/").permitAll()
                        .requestMatchers("/admin/**").hasRole("ADMIN")
                        .anyRequest().authenticated())
                .oauth2Login(Customizer.withDefaults()); 
                .oauth2Login(Customizer.withDefaults()) 
                .logout(logout -> logout.logoutSuccessHandler(logoutSuccessHandler)); 
        return http.build();
    }

HTTP/1.1 302
Location: http://localhost:8313/realms/catalogue/protocol/openid-connect/logout?id_token_hint=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJDQmg2elcyczUyY3hoMDFPRHRKZE4wbjlFem9WNk9CT2tqd2dITmJRWS13In0.eyJleHAiOjE3ODk3MTY0MTUs…&post_logout_redirect_uri=http://localhost:8213/

HTTP/1.1 302 Found
Set-Cookie: KEYCLOAK_IDENTITY=;Version=1;Path=/realms/catalogue/;Max-Age=0
Set-Cookie: KEYCLOAK_SESSION=;Version=1;Path=/realms/catalogue/;Max-Age=0
Location: http://localhost:8213/

java -Xmx512m -jar web/build/libs/web-0.0.1-SNAPSHOT.jar --spring.profiles.active=social
curl -s -i http://localhost:8213/oauth2/authorization/google | grep '^Location'
curl -s -i http://localhost:8213/oauth2/authorization/github | grep '^Location'

Location: https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=dummy-google-client-id&scope=openid%20profile%20email&state=reuQhz7YOnfSlCy8ysVJJ7dxoiGL9CyQNljLvTCfIik%3D&redirect_uri=http://localhost:8213/login/oauth2/code/google&nonce=fvHIJ4LuMDE9bTrfEQlOSWVxMHv0hQzpvUJietyb2RY&code_challenge=Ygcew9i2RgcMx5F-ziz-OPw0EZ9mwOJYrB3p9Utxmt0&code_challenge_method=S256
Location: https://github.com/login/oauth/authorize?response_type=code&client_id=dummy-github-client-id&scope=read:user&state=Wa9JNTf9jcIPPqEtJoNmLDMkZah0WkMyDx2rOUSqEng%3D&redirect_uri=http://localhost:8213/login/oauth2/code/github&code_challenge=Z8QK2pMK6WqrnxmJE5jPHtbF9rs90M3hnl4_PUdBP3o&code_challenge_method=S256

package com.example.api.common;
 
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
 
@Configuration
@EnableMethodSecurity
public class SecurityConfig {
 
    @Bean
    SecurityFilterChain apiSecurityFilterChain(HttpSecurity http, ProblemDetailSecurityHandler problemHandler) {
        http
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .oauth2ResourceServer(oauth2 -> oauth2
                        .jwt(Customizer.withDefaults())
                        .authenticationEntryPoint(problemHandler))
                .exceptionHandling(exceptions -> exceptions
                        .authenticationEntryPoint(problemHandler)
                        .accessDeniedHandler(problemHandler))
                .csrf(csrf -> csrf.disable())
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
        return http.build();
    }
}

package com.example.api.account;
 
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
 
@RestController
public class CallerController {
 
    @GetMapping("/api/me")
    public CallerResponse me(@AuthenticationPrincipal Jwt jwt, Authentication authentication) {
        return new CallerResponse(
                jwt.getSubject(),
                jwt.getClaimAsString("preferred_username"),
                jwt.getClaimAsString("azp"),
                jwt.getAudience(),
                authentication.getAuthorities().stream().map(GrantedAuthority::getAuthority).toList());
    }
}

package com.example.api.account;
 
import java.util.List;
 
public record CallerResponse(String subject, String username, String clientId, List<String> audience,
                             List<String> authorities) {
}

package com.example.api.report;
 
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
 
@RestController
public class ReportController {
 
    @GetMapping("/api/reports/stock")
    @PreAuthorize("hasRole('ADMIN')")
    public StockReport stock() {
        return new StockReport(3, 128);
    }
}

HTTP/1.1 401
WWW-Authenticate: Bearer realm="catalogue", resource_metadata="http://localhost:9213/.well-known/oauth-protected-resource"
Content-Type: application/problem+json
 
{"detail":"Valid credentials are required to access this resource.","instance":"/error","status":401,"title":"Unauthorized"}

curl -s -u reporting-service:reporting-service-secret -d grant_type=client_credentials \
  http://localhost:8313/realms/catalogue/protocol/openid-connect/token

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5…",
  "expires_in": 300,
  "refresh_expires_in": 0,
  "token_type": "Bearer",
  "not-before-policy": 0,
  "scope": "email profile"
}

{
  "exp": 1789716165,
  "iat": 1789715865,
  "jti": "trrtcc:5e62dd0b-b784-c9de-1e32-0096b4cab67f",
  "iss": "http://localhost:8313/realms/catalogue",
  "aud": [
    "catalogue-api",
    "account"
  ],
  "sub": "d9c52585-38d7-422f-9499-f10825b14634",
  "typ": "Bearer",
  "azp": "reporting-service",
  "acr": "1",
  "realm_access": {
    "roles": [
      "offline_access",
      "uma_authorization",
      "default-roles-catalogue"
    ]
  },
  "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "email profile",
  "email_verified": false,
  "clientHost": "192.168.65.1",
  "preferred_username": "service-account-reporting-service",
  "clientAddress": "192.168.65.1",
  "client_id": "reporting-service"
}

{"subject":"d9c52585-38d7-422f-9499-f10825b14634","username":"service-account-reporting-service","clientId":"reporting-service","audience":["catalogue-api","account"],"authorities":["SCOPE_email","FACTOR_BEARER","SCOPE_profile"]}

{"subject":"dfc3c0df-f01c-43c3-a4a5-a212699bbe09","username":"bob","clientId":"web-client","audience":["catalogue-api"],"authorities":["SCOPE_openid","SCOPE_email","FACTOR_BEARER","SCOPE_profile"]}

curl -s -u reporting-service:reporting-service-secret -d grant_type=client_credentials http://localhost:8313/realms/other/protocol/openid-connect/token | jq -r .access_token > other-realm.jwt
curl -s -u reporting-service:reporting-service-secret -d grant_type=client_credentials http://127.0.0.1:8313/realms/catalogue/protocol/openid-connect/token | jq -r .access_token > ip-issuer.jwt
SIG=$(cut -d. -f3 < service.jwt)
printf '%s' "$(cut -d. -f1,2 < service.jwt).$(printf '%s' "$SIG" | cut -c1-20)AAAAAAAA$(printf '%s' "$SIG" | cut -c29-)" > tampered.jwt
for f in other-realm ip-issuer tampered; do curl -s -i -H "Authorization: Bearer $(cat $f.jwt)" http://localhost:9213/api/me | grep -E '^HTTP|^WWW-Authenticate'; done

HTTP/1.1 401
WWW-Authenticate: Bearer realm="catalogue", error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Signed JWT rejected: Another algorithm expected, or no matching key(s) found", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:9213/.well-known/oauth-protected-resource"
HTTP/1.1 401
WWW-Authenticate: Bearer realm="catalogue", error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: The iss claim is not valid", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:9213/.well-known/oauth-protected-resource"
HTTP/1.1 401
WWW-Authenticate: Bearer realm="catalogue", error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Signed JWT rejected: Invalid signature", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:9213/.well-known/oauth-protected-resource"

{"subject":"77af2979-8d30-4510-a224-f1620dfb4b1c","username":"service-account-partner-service","clientId":"partner-service","audience":["account"],"authorities":["SCOPE_email","FACTOR_BEARER","SCOPE_profile"]}

HTTP/1.1 401
WWW-Authenticate: Bearer realm="catalogue", error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: The aud claim is not valid", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:9213/.well-known/oauth-protected-resource"

#!/bin/zsh
# Sends the same client-credentials token every 5 s from just before its exp to 75 s after it.
TOKEN=$(cat out/svc.jwt)
EXP=$(cut -d. -f2 <<< "$TOKEN" | tr '_-' '/+' | awk '{ while (length($0) % 4) $0 = $0 "="; print }' | base64 -d | jq .exp)
echo "exp = $(date -u -r $EXP +%H:%M:%S)"
while (( $(date +%s) < EXP - 5 )); do sleep 1; done
while (( $(date +%s) <= EXP + 75 )); do
  echo "$(date -u +%H:%M:%S) now-exp=$(( $(date +%s) - EXP ))s -> $(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $TOKEN" http://localhost:9213/api/me)"
  sleep 5
done
curl -s -i -H "Authorization: Bearer $TOKEN" http://localhost:9213/api/me | grep -E "^HTTP|^WWW-Authenticate|^Date"

exp = 07:22:45
07:22:40 now-exp=-5s -> 200
07:22:45 now-exp=0s -> 200
07:22:50 now-exp=5s -> 200
07:22:56 now-exp=11s -> 200
07:23:01 now-exp=16s -> 200
07:23:06 now-exp=21s -> 200
07:23:11 now-exp=26s -> 200
07:23:16 now-exp=31s -> 200
07:23:21 now-exp=36s -> 200
07:23:26 now-exp=41s -> 200
07:23:31 now-exp=46s -> 200
07:23:36 now-exp=51s -> 200
07:23:41 now-exp=56s -> 200
07:23:46 now-exp=61s -> 401
07:23:51 now-exp=66s -> 401
07:23:56 now-exp=71s -> 401
HTTP/1.1 401
WWW-Authenticate: Bearer realm="catalogue", error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Jwt expired at 2026-09-18T07:22:45Z", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:9213/.well-known/oauth-protected-resource"
Date: Fri, 18 Sep 2026 07:24:01 GMT

HTTP/1.1 403
Content-Type: application/problem+json
 
{"detail":"You are not allowed to perform this operation.","instance":"/api/reports/stock","status":403,"title":"Forbidden"}

java -Xmx512m -jar api/build/libs/api-0.0.1-SNAPSHOT.jar \
  --spring.security.oauth2.resourceserver.jwt.authorities-claim-name=realm_access.roles \
  --spring.security.oauth2.resourceserver.jwt.authority-prefix=ROLE_ \
  --logging.level.org.springframework.security.oauth2.server.resource.authentication=TRACE

JwtGrantedAuthoritiesConverter: Returning no authorities since could not find any claims that might contain scopes

java -Xmx512m -jar api/build/libs/api-0.0.1-SNAPSHOT.jar \
  "--spring.security.oauth2.resourceserver.jwt.authorities-claim-expressions=['realm_access']['roles']" \
  --spring.security.oauth2.resourceserver.jwt.authority-prefix=ROLE_

import org.springframework.expression.spel.standard.SpelExpressionParser; 
import org.springframework.security.oauth2.server.resource.authentication.DelegatingJwtGrantedAuthoritiesConverter; 
import org.springframework.security.oauth2.server.resource.authentication.ExpressionJwtGrantedAuthoritiesConverter; 
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter; 
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter; 
 
    @Bean
    JwtAuthenticationConverter jwtAuthenticationConverter() { 
        ExpressionJwtGrantedAuthoritiesConverter realmRoles = new ExpressionJwtGrantedAuthoritiesConverter( 
                new SpelExpressionParser().parseExpression("['realm_access']['roles']")); 
        realmRoles.setAuthorityPrefix("ROLE_"); 
        JwtAuthenticationConverter converter = new JwtAuthenticationConverter(); 
        converter.setJwtGrantedAuthoritiesConverter( 
                new DelegatingJwtGrantedAuthoritiesConverter(new JwtGrantedAuthoritiesConverter(), realmRoles)); 
        return converter; 
    } 

package com.example.web.catalogue;
 
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.web.client.OAuth2ClientHttpRequestInterceptor;
import org.springframework.web.client.RestClient;
 
@Configuration
public class CatalogueApiConfig {
 
    @Bean
    RestClient catalogueApi(OAuth2AuthorizedClientManager authorizedClientManager,
                            @Value("${catalogue-api.base-url}") String baseUrl) {
        OAuth2ClientHttpRequestInterceptor interceptor = new OAuth2ClientHttpRequestInterceptor(authorizedClientManager);
        interceptor.setClientRegistrationIdResolver(request -> "keycloak");
        return RestClient.builder()
                .baseUrl(baseUrl)
                .requestInterceptor(interceptor)
                .build();
    }
}

package com.example.web.catalogue;
 
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.client.RestClient;
 
@RestController
public class CatalogueController {
 
    private final RestClient catalogueApi;
 
    public CatalogueController(@Qualifier("catalogueApi") RestClient catalogueApi) {
        this.catalogueApi = catalogueApi;
    }
 
    @GetMapping("/catalogue/caller")
    public ApiCaller caller() {
        return catalogueApi.get().uri("/api/me").retrieve().body(ApiCaller.class);
    }
}

{"subject":"dfc3c0df-f01c-43c3-a4a5-a212699bbe09","username":"bob","clientId":"web-client","audience":["catalogue-api"],"authorities":["SCOPE_openid","SCOPE_email","FACTOR_BEARER","ROLE_ADMIN","SCOPE_profile"]}

package com.example.web.reporting;
 
import static org.springframework.security.oauth2.client.web.client.RequestAttributePrincipalResolver.principal;
 
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.AuthorizedClientServiceOAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.client.OAuth2ClientHttpRequestInterceptor;
import org.springframework.security.oauth2.client.web.client.RequestAttributePrincipalResolver;
import org.springframework.web.client.RestClient;
 
@Configuration
public class ReportingApiConfig {
 
    @Bean
    RestClient reportingApi(ClientRegistrationRepository clientRegistrations,
                            OAuth2AuthorizedClientService authorizedClientService,
                            @Value("${catalogue-api.base-url}") String baseUrl) {
        AuthorizedClientServiceOAuth2AuthorizedClientManager manager =
                new AuthorizedClientServiceOAuth2AuthorizedClientManager(clientRegistrations, authorizedClientService);
        OAuth2ClientHttpRequestInterceptor interceptor = new OAuth2ClientHttpRequestInterceptor(manager);
        interceptor.setClientRegistrationIdResolver(request -> "reporting");
        interceptor.setPrincipalResolver(new RequestAttributePrincipalResolver());
        return RestClient.builder()
                .baseUrl(baseUrl)
                .defaultRequest(request -> request.attributes(principal("reporting-service")))
                .requestInterceptor(interceptor)
                .build();
    }
}

#!/bin/zsh
# Counts POSTs to Keycloak's token endpoint (from its HTTP access log) around each batch of calls.
tokens() { docker logs sba-a13-keycloak 2>&1 | grep -c 'POST /realms/catalogue/protocol/openid-connect/token'; }
step() { local label=$1; shift; local before=$(tokens); local out=$("$@" | tail -1); sleep 1; echo "$label: $out| $(( $(tokens) - before )) token request(s)"; }
five() { for i in 1 2 3 4 5; do curl -s -o /dev/null -w '%{http_code} ' -b $1 -c $1 http://localhost:8213$2; done; }
step "log in as bob" ./flow.sh bob Builder-2026 out/count-bob
step "bob: 5 x /catalogue/caller (user token relay)" five out/count-bob/jar /catalogue/caller
step "bob: 5 x /reports/caller (client credentials)" five out/count-bob/jar /reports/caller
step "log in as alice" ./flow.sh alice Wonderland-2026 out/count-alice
step "alice: 5 x /reports/caller (client credentials)" five out/count-alice/jar /reports/caller

log in as bob: 6-me.txt: HTTP/1.1 200  | 1 token request(s)
bob: 5 x /catalogue/caller (user token relay): 200 200 200 200 200 | 0 token request(s)
bob: 5 x /reports/caller (client credentials): 200 200 200 200 200 | 1 token request(s)
log in as alice: 6-me.txt: HTTP/1.1 200  | 1 token request(s)
alice: 5 x /reports/caller (client credentials): 200 200 200 200 200 | 0 token request(s)