From b9b89035f6b9fe89b2ad41eb60643eb347fe39e0 Mon Sep 17 00:00:00 2001 From: Philipp Gerhard Date: Fri, 17 Apr 2020 14:26:22 +0200 Subject: [PATCH] Documented dependencies opaque Resource Server Extended the documentation for the opaque Resource Server in order to clearly state which dependencies are required in order for the minimal deployment to work. Replaced dead link for Contribute guidelines in README.adoc Closes gh-8391 --- README.adoc | 2 +- .../_includes/reactive/oauth2/resource-server.adoc | 9 ++++++++- .../servlet/oauth2/oauth2-resourceserver.adoc | 10 +++++++++- 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/README.adoc b/README.adoc index 3ebd60d0fa..be2ac206d2 100644 --- a/README.adoc +++ b/README.adoc @@ -58,7 +58,7 @@ Check out the https://stackoverflow.com/questions/tagged/spring-security[Spring https://spring.io/services[Commercial support] is available too. == Contributing -https://help.github.com/articles/creating-a-pull-request[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/master/CONTRIBUTING.md[contributor guidelines] for details. +https://help.github.com/articles/creating-a-pull-request[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/master/CONTRIBUTING.adoc[contributor guidelines] for details. == License Spring Security is Open Source software released under the diff --git a/docs/manual/src/docs/asciidoc/_includes/reactive/oauth2/resource-server.adoc b/docs/manual/src/docs/asciidoc/_includes/reactive/oauth2/resource-server.adoc index 35a8555f4c..cfb4f85fcb 100644 --- a/docs/manual/src/docs/asciidoc/_includes/reactive/oauth2/resource-server.adoc +++ b/docs/manual/src/docs/asciidoc/_includes/reactive/oauth2/resource-server.adoc @@ -14,7 +14,8 @@ This authorization server can be consulted by resource servers to authorize requ A complete working example for {gh-samples-url}/boot/oauth2resourceserver-webflux[*JWTs*] is available in the {gh-samples-url}[Spring Security repository]. ==== -== Dependencies +[[webflux-oauth2resourceserver-jwt-minimaldependencies]] +== Minimal Dependencies for JWT Most Resource Server support is collected into `spring-security-oauth2-resource-server`. However, the support for decoding and verifying JWTs is in `spring-security-oauth2-jose`, meaning that both are necessary in order to have a working resource server that supports JWT-encoded Bearer Tokens. @@ -549,6 +550,12 @@ ReactiveJwtDecoder jwtDecoder() { return jwtDecoder; } ---- +[[webflux-oauth2resourceserver-opaque-minimaldependencies]] +=== Minimal Dependencies for Introspection +As described in <> most of Resource Server support is collected in `spring-security-oauth2-resource-server`. +However unless a custom <> is provided, the Resource Server will fallback to ReactiveOpaqueTokenIntrospector. +Meaning that both `spring-security-oauth2-resource-server` and `oauth2-oidc-sdk` are necessary in order to have a working minimal Resource Server that supports opaque Bearer Tokens. +Please refer to `spring-security-oauth2-resource-server` in order to determin the correct version for `oauth2-oidc-sdk`. [[webflux-oauth2resourceserver-opaque-minimalconfiguration]] === Minimal Configuration for Introspection diff --git a/docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-resourceserver.adoc b/docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-resourceserver.adoc index 97b161d6c1..0cae73201c 100644 --- a/docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-resourceserver.adoc +++ b/docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-resourceserver.adoc @@ -58,7 +58,8 @@ image:{icondir}/number_4.png[] If authentication is successful, then __Success__ * The <> is set on the <>. * The `BearerTokenAuthenticationFilter` invokes `FilterChain.doFilter(request,response)` to continue with the rest of the application logic. -=== Dependencies for JWT +[[oauth2resourceserver-jwt-minimaldependencies]] +=== Minimal Dependencies for JWT Most Resource Server support is collected into `spring-security-oauth2-resource-server`. However, the support for decoding and verifying JWTs is in `spring-security-oauth2-jose`, meaning that both are necessary in order to have a working resource server that supports JWT-encoded Bearer Tokens. @@ -1052,6 +1053,13 @@ NOTE: Spring isn't a cache provider, so you'll need to make sure to include the NOTE: Whether it's socket or cache timeouts, you may instead want to work with Nimbus directly. To do so, remember that `NimbusJwtDecoder` ships with a constructor that takes Nimbus's `JWTProcessor`. +[[oauth2resourceserver-opaque-minimaldependencies]] +=== Minimal Dependencies for Introspection +As described in <> most of Resource Server support is collected in `spring-security-oauth2-resource-server`. +However unless a custom <> is provided, the Resource Server will fallback to NimbusOpaqueTokenIntrospector. +Meaning that both `spring-security-oauth2-resource-server` and `oauth2-oidc-sdk` are necessary in order to have a working minimal Resource Server that supports opaque Bearer Tokens. +Please refer to `spring-security-oauth2-resource-server` in order to determin the correct version for `oauth2-oidc-sdk`. + [[oauth2resourceserver-opaque-minimalconfiguration]] === Minimal Configuration for Introspection