Example: Java Spring Boot SSO integration

Add the toolkit

In your pom.xml file, add the spring-boot-starter-oauth2-client dependency. The following code provides an example:

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.4.1</version>
</parent>
<properties>
    <java.version>8</java.version>
</properties>
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-client</artifactId>
    </dependency>
</dependencies>

Configure IDaaS information

In your application.properties file, configure the client_id, client_secret, and issuer-uri.

spring.security.oauth2.client.registration.aliyunidaas.client-id=app_***
spring.security.oauth2.client.registration.aliyunidaas.client-secret=CS***
spring.security.oauth2.client.provider.aliyunidaas.issuer-uri=<issuer>

You can obtain this information after creating the application. For more information, see Connect self-developed applications to IDaaS for SSO.

Configure Spring Security for OAuth

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .anyRequest().authenticated()
            .and()
            .oauth2Login();
    }
}

Obtain user information

The toolkit automatically handles all authorization calls and id_token validation. You can obtain the user's information by injecting @AuthenticationPrincipal OAuth2User user:

import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.core.user.OAuth2User;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class SampleController {
    @GetMapping("/user")
    public OAuth2User user(@AuthenticationPrincipal OAuth2User user) {
        return user;
    }
}

You can then expose the user information at the /user endpoint to verify the result:

Use this user information to sign the user in and complete the SSO process.

Configuration for a proxy service

If you deploy the application behind a proxy service, such as Alibaba Cloud SLB or Nginx, the following issue may occur:

• A user accesses the application at https://www.example.com.

• During the OIDC login redirect, the generated redirect_uri changes to an internal address like http://127.0.0.1:8080/oauth2/authorization/aliyunidaas, which causes the login to fail.

To resolve this issue, modify how Spring Boot generates the redirect_uri:

1. In your Spring Boot configuration file, add the following property:

   server.forward-headers-strategy = NATIVE

2. If you use Alibaba Cloud SLB, go to the advanced configuration of your SLB instance and select Use the X-Forwarded-Proto header to retrieve the listener protocol.

3. If you have an Nginx proxy between an SLB instance and your application, configure the following on the proxy:

   proxy_set_header Host $host;
   proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

4. If users connect directly to your service through Nginx over HTTPS, configure the following:

   proxy_set_header Host $host;
   proxy_set_header X-Forwarded-Proto https;