OAuth2 Resource Server
OAuth2 Resource Server PATTERN mein, TUMHARA REST API, KHUD, USERS ko, AUTHENTICATE NAHI karta — EK SEPARATE, TRUSTED AUTHORIZATION SERVER (jaise Auth0, Keycloak, ya COMPANY's OWN AUTH SERVICE), TOKENS, ISSUE karta hai, aur, TUMHARA API, SIRF, IN TOKENS ko, VALIDATE karta hai.
spring-boot-starter-oauth2-resource-server, issuer-uri CONFIGURE karte hi, AUTOMATICALLY, AUTHORIZATION SERVER SE, PUBLIC KEYS, FETCH karके, INCOMING JWT TOKENS ki, SIGNATURE, VALIDATE kar deता hai — MANUAL, TOKEN VALIDATION LOGIC, LIKHNE ki, ZAROORAT NAHI.
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
# application.properties:
spring.security.oauth2.resourceserver.jwt.issuer-uri=https://auth.example.com
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
return http.build();
}
}- Resource Server = tokens VALIDATE karta hai, ISSUE NAHI karta (Authorization Server ISSUE karta hai)
- issuer-uri SET karte hi, PUBLIC KEYS, AUTOMATICALLY, fetch hoती hain
- Microservices mein, COMMON — central auth service + multiple resource servers
JWT TOKENS, "SCOPES" (jaise, "read:products", "write:products") CARRY kar sakte hain — @PreAuthorize("hasAuthority('SCOPE_write:products')") SE, SPECIFIC, ENDPOINTS ko, SPECIFIC, SCOPES tak, RESTRICT kiya ja sakta hai.
@PreAuthorize("hasAuthority('SCOPE_write:products')")
@PostMapping
public ProductDto create(@RequestBody ProductCreateDto dto) { }Standard, JWT CLAIMS (sub, exp) ke, ALAWA, CUSTOM, CLAIMS (jaise, "tenantId", "organizationId") bhi, TOKEN mein, EMBED ho sakte hain — @AuthenticationPrincipal Jwt jwt SE, IN CUSTOM, CLAIMS ko, ACCESS kiya ja sakta hai, MULTI-TENANT, APPLICATIONS ke liye, ESSENTIAL.
- Standard claims (sub, exp, iat) = JWT spec ka, HISSA
- Custom claims (tenantId, role) = application-specific, DATA