Spring AuthorizationServer를 사용한 OAuth2 인증 서버 구축 (1)

dependencies { // authentication server implementation 'org.springframework.boot:spring-boot-starter-oauth2-authorization-server' // oauth2 client implementation "org.springframework.boot:spring-boot-starter-oauth2-client" // security implementation 'org.springframework.boot:spring-boot-starter-security' // web implementation 'org.springframework.boot:spring-boot-starter-web' // lombok compileOnly 'org.projectlombok:lombok' annotationProcessor 'org.projectlombok:lombok' // test testImplementation 'org.springframework.boot:spring-boot-starter-test' testImplementation 'org.springframework.boot:spring-boot-testcontainers' testImplementation 'org.springframework.security:spring-security-test' testImplementation 'org.testcontainers:junit-jupiter' testRuntimeOnly 'org.junit.platform:junit-platform-launcher' testImplementation 'org.testcontainers:mysql' testImplementation 'org.testcontainers:junit-jupiter' // spring-restdocs testImplementation 'org.springframework.restdocs:spring-restdocs-mockmvc' // database implementation 'org.springframework.boot:spring-boot-starter-data-jpa' runtimeOnly 'com.mysql:mysql-connector-j' }

@Entity @Table(name = "roles") public class Role implements Serializable { @Id @GeneratedValue private Long id; @Getter @Column(nullable = false, unique = true) private String name; @Override public int hashCode() { return Objects.hashCode(id); } @Override public boolean equals(Object o) { if (this == o) { return true; } if (!(o instanceof Role role)) { return false; } return Objects.equals(id, role.id); } }

public interface RoleRepository extends JpaRepository<Role, Long> { Optional<Role> findByName(String name); }

@Getter @Entity @Table(name = "users") public class User implements Serializable { @Id @GeneratedValue private Long id; @Column(nullable = false, unique = true) private String username; @Column(nullable = false) private String password; @Column(nullable = false) private boolean enabled; @ManyToMany(fetch = FetchType.EAGER) @JoinTable( name = "user_roles", joinColumns = @JoinColumn(name = "user_id"), inverseJoinColumns = @JoinColumn(name = "role_id") ) private Set<Role> roles = new HashSet<>(); public User() { } public User(String username, String password) { this.username = username; this.password = password; this.enabled = true; } }

public interface UserRepository extends JpaRepository<User, Long> { Optional<User> findByUsername(String username); }

@RequiredArgsConstructor public class CustomUserDetails implements UserDetails { private final User user; @Override public Collection<? extends GrantedAuthority> getAuthorities() { return user.getRoles().stream() .map(role -> new SimpleGrantedAuthority(role.getName())) .toList(); } @Override public String getPassword() { return user.getPassword(); } @Override public String getUsername() { return user.getUsername(); } @Override public boolean isEnabled() { return user.isEnabled(); } }

@RequiredArgsConstructor @Service public class DefaultUserDetailsService implements UserDetailsService { private final UserService userService; @Override public UserDetails loadUserByUsername(String username) { var user = userService.findByUsername(username); return new CustomUserDetails(user); } }

@EnableWebSecurity @Configuration(proxyBeanMethods = false) public class DefaultSecurityConfig { @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } // OAuth2 인증 서버의 설정을 처리하는 필터 체인 설정기를 생성합니다. @Bean @Order(Ordered.HIGHEST_PRECEDENCE) public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception { // OAuth2 인증 서버의 설정을 처리하는 필터 체인 설정기를 생성합니다. var authorizationServerConfigurer = OAuth2AuthorizationServerConfigurer.authorizationServer(); // OAuth2 인증 서버의 엔드포인트와 일치하는 요청만 필터링하도록 설정합니다. // 이를 통해 인증 서버의 엔드포인트에 대한 요청만 해당 필터가 처리하도록 합니다. return http // OAuth2 인증 서버의 엔드포인트에 매칭되는 요청만 처리합니다. .securityMatcher(authorizationServerConfigurer.getEndpointsMatcher()) .with( // OAuth2 인증 서버의 설정을 처리하는 필터 체인 설정기를 적용합니다. authorizationServerConfigurer, // OpenID Connect 1.0을 활성화하여 ID 토큰 발급을 지원합니다. authorizationServer -> authorizationServer.oidc(Customizer.withDefaults()) ) .build(); } // 기본적인 보안 설정을 처리하는 필터 체인 설정기를 생성합니다. @Bean public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception { return http // 모든 요청에 대해 인증을 요구합니다. // POST /api/users, POST /login 엔드포인트에 대해서는 인증을 요구하지 않습니다. .authorizeHttpRequests(request -> request .requestMatchers(HttpMethod.POST, "/api/users", "/login").permitAll() .anyRequest().authenticated()) // CSRF 보호 기능을 비활성화합니다. .csrf(AbstractHttpConfigurer::disable) // 폼 로그인을 활성화합니다. .formLogin(Customizer.withDefaults()) .build(); } }

@RequiredArgsConstructor @Service public class UserService { private final UserRepository userRepository; private final PasswordEncoder passwordEncoder; private final RoleRepository roleRepository; public void register(String username, String password) { if (userRepository.existsByUsername(username)) { throw new IllegalArgumentException("User already exists"); } var user = new User(username, passwordEncoder.encode(password)); user.getRoles().add(roleRepository.findByName("USER")); userRepository.save(user); } public User findByUsername(String username) { return userRepository.findByUsername(username); } }

public record UserRegisterRequest(String username, String password) { }

@RequiredArgsConstructor @RestController public class UserController { private final UserService userService; @PostMapping("/api/users") public ResponseEntity<Void> register(@RequestBody UserRegisterRequest userRegisterRequest) { userService.register(userRegisterRequest.username(), userRegisterRequest.password()); return ResponseEntity.ok().build(); } }

@Component @RequiredArgsConstructor public class RoleInitializer implements ApplicationRunner { private final RoleRepository roleRepository; @Override public void run(ApplicationArguments args) { roleRepository.save(new Role("USER")); roleRepository.save(new Role("ADMIN")); } }