Multi-tenancy OAuth with Spring Security 5.2
Why Stack Overflow recommends it
Stack Overflow users link it when asked how a Spring Security resource server or client can trust multiple authorization servers or register clients dynamically per tenant.
Recommended by 1 people across 1 different months, 2020 to 2022.
What it is
A SpringOne Platform 2019 conference talk by Josh Cummings of Pivotal on running OAuth in multi-tenant Spring applications. It introduces AuthenticationManagerResolver and ClientRegistrationRepository and builds a typical OAuth app up into a dynamic, database-driven multi-tenant deployment.
What people said
Recommends Norbert Dopjera · 2020-05 · Stack Overflow · on “How do I use multiple 'JWK Set Uri' values in the same Spring Boot app?”
With spring boot this is not possible to do out of the box right now. Spring Security 5.3 provides functionality to do this (spring boot 2.2.6 still doesn't support spring security 5.3). Please see following issues: [LINK] [LINK] It is possible to do manual configuration of resource server to use multiple identity providers, by following links that i have provided. Provided links are mainly for spring boot webflux development. For basic spring boot web development please see this video: [this video]
Cites Eleftheria Stein-Kousathana · 2020-11 · Stack Overflow · on “How to secure apis with ResourceServer implementation with multiple resource ids?”
I assume you mean to say that the different tokens are obtained from different authorization servers. In this case you can look into multi-tenant applications. One way to differentiate tenants is by the issuer claim. For this you can use a JwtIssuerAuthenticationManagerResolver or JwtIssuerReactiveAuthenticationManagerResolver . @Bean SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { JwtIssuerReactiveAuthenticationManagerResolver authenticationManagerResolver = new JwtIssuerReactiveAuthenticationManagerResolver( " [LINK] ", " [LINK] "); http .authorizeExchange(exchanges -> exchanges .anyExchange().authenticated() ) .oauth2ResourceServer(oauth2 -> oauth2 .authenticat
Cites Pankaj Chauhan · 2022-09 · Stack Overflow · on “How to implement security in Spring Cloud API Gateway with Key Cloak for Multi-tenant Application”
Use ReactiveClientRegistrationRepository to register your clients dynamically at runtime. You can then plug this implementation to a custom Webfilter, which will use your custom repository to compute the client details based on the logged in user's realm(which can be the hostname, email etc.) import java.util.HashMap; import java.util.Map; import java.util.Optional; import reactor.core.publisher.Mono; import org.springframework.security.oauth2.client.registration.ClientRegistration; import org.springframework.security.oauth2.client.registration.ClientRegistrations; import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository; import org.springframework.