[Spring Security] 8-1. OAuth2 Resource Server

1. OAuth2 Resource Server

• 보호된 자원을 관리하는 서버
• ✅ 보호된 자원의 요청에 대한 인증 과정을 담당함

 

Protect Access with an OAuth2 Access Token

구분	설명	검증
JWT	자체 서명 토큰	public key 사용
Opaque Token	토큰 내용을 알 수 없는 토큰	인정 서버의 introspection 엔드포인트에 확인 요청

 

설정) JWT

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://my-auth-server.com

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .oauth2ResourceServer(oauth2 -> oauth2.jwt());
            
        return http.build();
    }

    @Bean
    public JwtDecoder jwtDecoder() {
        return JwtDecoders.fromIssuerLocation("https://my-auth-server.com");
    }
}

 

설정) Opaque Token

spring:
  security:
    oauth2:
      resourceserver:
        opaquetoken:
          introspection-uri: https://my-auth-server.com/oauth2/introspect
          client-id: my-client-id
          client-secret: my-client-secret

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .oauth2ResourceServer(oauth2 -> oauth2.opaqueToken());
        
        return http.build();
    }

    @Bean
    public OpaqueTokenIntrospector opaqueTokenIntrospector() {
        return new SpringOpaqueTokenIntrospector(
            "https://my-auth-server.com/oauth2/introspect",
            "my-client-id",
            "my-client-secret");
    }
}

 

Protect Access with a custom JWT

• 발급된 Access Token을 검증하는 방법
• ✅ BearerTokenAuthenticationFilter + JwtAuthenticationProvider (NimbusJwtDecoder)

 

설정) Custom Access Token 검증

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          public-key-location: classpath:my-public-key.pub

• 공개키만 등록하면 됨 (NimbusJwtDecoder)