Development and Testing

spring:
  security:
    oauth2:
      client:
        registration:
          eduid:
            client-id: my_unique_client_id
            scope: openid,profile,email
            authorization-grant-type: authorization_code
            redirect-uri: https://example.com/protected/redirect_uri
            client-authentication-method: private_key_jwt
            client-name: my_client_name
        provider:
          eduid:
            # Either
            # https://login.test.eduid.ch/ (TEST)
            # or
            # https://login.eduid.ch/ (PROD)
            issuer-uri: https://login.test.eduid.ch/

@Bean
public SecurityFilterChain oAuthFilterChain(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/", "/error").permitAll()
            .anyRequest().authenticated()
            .and()
            .logout().logoutSuccessUrl("/")
            .and()
            .logout().logoutSuccessHandler(oidcLogoutSuccessHandler())
            .and()
            .oauth2Login().tokenEndpoint().accessTokenResponseClient(tokenResponseClient());

    return http.build();
}

DefaultAuthorizationCodeTokenResponseClient tokenResponseClient() {

    Function<ClientRegistration, JWK> jwkResolver = (clientRegistration) -> {
        if (clientRegistration.getClientAuthenticationMethod().equals(ClientAuthenticationMethod.PRIVATE_KEY_JWT)) {

            // Use an RSA key for Client Authentication
            return new RSAKey.Builder(getRSAPublicKey())
                    .privateKey(getRSAPrivateKey())
                    .keyID("my_unique_rsa_key_ID") // The key ID you specified in the resource registry
                    .build();

            // Use an EC key for Client Authentication
            return new ECKey.Builder(Curve.P_256, getECPublicKey())
                    .privateKey(getECPrivateKey())
                    .keyID("my_unique_ec_key_ID") // The key ID you specified in the resource registry
                    .build();

        }
        return null;
    };

    // Apply the JWK resolver to the TokenResponseClient
    OAuth2AuthorizationCodeGrantRequestEntityConverter requestEntityConverter =
            new OAuth2AuthorizationCodeGrantRequestEntityConverter();
    requestEntityConverter.addParametersConverter(
            new NimbusJwtClientAuthenticationParametersConverter<>(jwkResolver));

    DefaultAuthorizationCodeTokenResponseClient tokenResponseClient =
            new DefaultAuthorizationCodeTokenResponseClient();
    tokenResponseClient.setRequestEntityConverter(requestEntityConverter);

    return tokenResponseClient;
}

export const authCodeFlowConfig: AuthConfig = {
    // Url of the Identity Provider:
    // https://login.test.eduid.ch/ (TEST)
    // or
    // https://login.eduid.ch/ (PROD)
    issuer: 'https://login.test.eduid.ch/',

    // URL of the SPA to redirect the user to after login
    redirectUri: 'https://example.com/protected/redirect_uri',

    // The SPA's id. The SPA is registered with this id at the auth-server
    clientId: 'my_unique_client_id',

    // Authorization code flow
    responseType: 'code',

    // The scopes requested in the resource registry 
    scope: 'openid profile email offline_access',

    showDebugInformation: true,
};

// Then in the entry page of the protected area, the OAuth Service needs to be loaded such that
// the user is redirected to the IdP's login page

ngOnInit(): void {
    this.oauthService.configure(authCodeFlowConfig);
    this.oauthService.loadDiscoveryDocumentAndLogin();

    // Automatically load user profile
    this.oauthService.events
      .pipe(filter((e) => e.type === 'token_received'))
      .subscribe((_) => this.oauthService.loadUserProfile());
  }
}