Goodbye, Passwords

with Spring Security lead Rob Winch and Spring Developer Advocate Josh Long

preflight

go to safari and delete all the old passkeys. TAN: why are passkeys for the entire OS in their bloody browser?
shut down all the docker compose instances
reset database with new import
install the schema in misc/legacy-schema.sql to PostgreSQL by going to /Users/jlong/Desktop/talk/springone-2024/passwordless-with-rob-winch and running init_db.sh
Bring up slides

demo

intro
authN v authZ
MAKE SURE TO MIGRATE TO application.yml ASAP.
start.spring.io: service is called auth, add: web, jdbc, security, graalvm, and postgresql.

create a simple hello controller, restart

@Controller
@ResponseBody
class SecuredEndpoint {
  
    @GetMapping("/")
    Map<String, String> hello(Principal principal) {
        return Map.of("hello", principal.getName());
    }
}

spring boot configures default user/random password
where does that come from? u can change with properties
but ultimately it's an object. the root of all authentication is AuthenticationManager. its a little open ended.
UserDetailsService concerns itself specifically with passwords, which are a common type of authentication (but not the only ones, importantly for later)
register InMemoryUserDetailsManager with different users and roles for each

    @Bean
    InMemoryUserDetailsManager userDetailsService() {
        var users = User.withDefaultPasswordEncoder();
        return new InMemoryUserDetailsManager(
                users.username("rob").password("pw").roles("USER", "ADMIN").build(),
                users.username("josh").password("pw").roles("USER").build()
        );
    }

add the endpoint:

    @GetMapping ("/admin")
    Map<String, String> helloPrincipal(Principal principal) {
        return Map.of("hello administrator ", principal.getName());
    }

now what do those roles buy us? let's say we created another endpoint (admin-only endpoint) and want to secure it. configure authorization based on roles, like this.

 @Bean
    SecurityFilterChain securityWebFilterChain(HttpSecurity httpSecurity) throws Exception {
        return httpSecurity
             .authorizeHttpRequests(http -> http
                .requestMatchers("/admin").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults())
            .build();
    }

so weve got authz,n; go to the InMemoryUserDetailsManager and print out rob's getPasssword(); it's encoded! Who's done that? PasswordEncoder did that.
RW: password history discussion by Rob
make sure to disambiguate encoding vs encryption
turns out we have an existing system setup using sha256. as we talked about, that's no longer secure. but how do we migrate them if the password encoding is a one way ticket? simple, we do it at the time of login, when we have a known-to-be-valid password.
to see this in action, we have to fix a few things:
we need to migrate to a durable store. let's use JDBC.

	@Bean
	JdbcUserDetailsManager jdbcUserDetailsService(DataSource dataSource) {
		return new JdbcUserDetailsManager(dataSource);
	}

as it stands we won't be able to login. our passwords are in the old format. let's fix that.
run select * from users; see the problem? the data is old.
run a migration to set the password to be : update users set password = '{sha256}' || password
and finally the JDBC store won't automatically handle persisting the updated passwords.
RW: talk about password upgrades

@Bean
UserDetailsPasswordService userDetailsPasswordService(UserDetailsManager userDetailsManager) {
	return (user, newPassword) -> {
		var updated = User.withUserDetails(user).password(newPassword).build();
		userDetailsManager.updateUser(updated);
		return updated;
	};
}

now restart the app and login as rob or josh and see that their pw in the db users table has been upgraded transparently. nice!
RW: Passkeys slides
ensure to install webauthn support

git clone https://github.com/rwinch/spring-security-webauthn/
cd spring-security-webauthn
./gradlew publishToMavenLocal

add the dependency:

    <dependency>
        <groupId>io.github.rwinch.webauthn</groupId>
        <artifactId>spring-security-webauthn</artifactId>
        <version>0.0.1-SNAPSHOT</version>
    </dependency>

Add snapshot repository

	<repositories>
		<repository>
			<id>spring-snapshot</id>
			<url>https://repo.spring.io/snapshot</url>
		</repository>
	</repositories>

specify the following in pom.xml:

	<spring-security.version>6.4.0-SNAPSHOT</spring-security.version>

add the following to the config:

  .with(webauthn() ,c -> c 
		.allowedOrigins("http://localhost:8080")
		.rpId("localhost")
		.rpName("Bootiful Passkeys")
)

start the app and visit http://localhost:8080/webauthn/register
logout
http://localhost:8080/ log in with passkey
- NOTE: If fails check if remembered to clear old passkeys
RW: magic links 101 - slides
add the onetimetoken configuration element:

	.oneTimeTokenLogin(configurer -> configurer.generatedOneTimeTokenSuccessHandler((request, response, oneTimeToken) -> {
		var msg = "go to http://localhost:8080/login/ott?token=" + oneTimeToken.getTokenValue();
		System.out.println(msg);
		response.setContentType(MediaType.TEXT_PLAIN_VALUE);
		response.getWriter().write("you've got console mail!");
	}))

EZ! were now logged in with naught but a magic link. now what about your services? do you need to login like this for each service u stand up? wouldnt it be nice if you could centralize all this configuration in one place and give your other services and appos a means to benefit from that?
that's the power of Spring Authorization Service.
to see it in action lets transform our app into a Spring Authorization Server. All we need to do is add the Spring Authorization Server dependency ad then configure an OAuth client.
RW: what's an OAuth?
so copy and paste the requisite configuration:

spring:
  security:
    oauth2:
      authorizationserver:
        client:
          oidc-client:
            registration:
              client-id: "spring"
              client-secret: "spring"
              client-authentication-methods:
                - "client_secret_basic"
              authorization-grant-types:
                - "authorization_code"
                - "refresh_token"
              redirect-uris:
                - "http://127.0.0.1:8081/login/oauth2/code/spring"
              scopes:
                - "openid"
                - "profile"

this establishes a new client called oidc-client. other apps will say they're connecting as this client on behalf of a user context. now we need to standup a client. that client will have a filter that rejects requests and forces an authentication. which is of course what we've just spent a lot of time simplifying. lets build a new client.
we'll also need a seperate spring authorization security filter chain, like this:

	 @Bean
    @Order(1)
    SecurityFilterChain authServerFilterChain(HttpSecurity http) throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
                .oidc(Customizer.withDefaults());
        http
                .exceptionHandling((exceptions) -> exceptions
                        .defaultAuthenticationEntryPointFor(
                                new LoginUrlAuthenticationEntryPoint("/login"),
                                new MediaTypeRequestMatcher(MediaType.TEXT_HTML)
                        )
                )
                .oauth2ResourceServer((resourceServer) -> resourceServer.jwt(Customizer.withDefaults()));

        return http.build();
    }

restart. now we have an authorization server! nice. confirm as much by visiting http://localhost:8080/.well-known/openid-configuration. great.
now we need a client.
start.spring.io and create a new project called oauth-login: security , web , oauth client.
configure some properties:

spring:

  application:
    name: oauth-login

  security:
    oauth2:
      client:
        registration:
          spring:
            scope: openid,profile
            client-id: spring
		  	client-secret: "{noop}spring"
        provider:
          spring:
            issuer-uri: http://localhost:8080
server:
  port: 8081

add a simple endpoint to the oauth client.

@Controller
@ResponseBody
class ClientApplication {

	@GetMapping("/")
	Map<String, String> hello(Principal principal) {
		return Map.of("message", "hello, from client " + principal.getName());
	}
}

restart. visit the oauth client on port 8081: http://127.0.0.1:8081. itll redirect us back to the auth server which in turn wil dump us back on the client, this time after having established a token. so were authenticated but the user never had to enter a pasword on the client. they can trust the auth server as the one true place. u see this scheme countles places. google. facebook. twitter. linkedin. github. etc.
it works.
now what if i have a downstream microservice to which the client wants to make calls? simple. sertup a resource server.
start.spring.io: resource server , web, graalvm
configure port: 8082
configure issuer uri : http://localhost:8080
add a controller in the resource server to be exactly the same as in the client:

@Controller
@ResponseBody
class ClientController {

	@GetMapping("/")
	Map<String, String> hello(Principal principal) {
		return Map.of("message", "hello, " + principal.getName());
	}
}

and now change the client to relay the token in the request:


@Controller
@ResponseBody
class ClientController {

    private final RestClient http;

    ClientController(RestClient.Builder http) {
        this.http = http.build();
    }

    @GetMapping("/")
    Map<String, String> hello(@RegisteredOAuth2AuthorizedClient OAuth2AuthorizedClient oAuth2AuthorizedClient) {
        var token = oAuth2AuthorizedClient.getAccessToken();
        return http
                .get()
                .uri("http://localhost:8082/")
                .headers(httpHeaders -> httpHeaders.setBearerAuth(token.getTokenValue()))
                .retrieve()
                .body(new ParameterizedTypeReference<>() {
                });

    }
}

go back to the client as before: 127.0.0.1:8081/

joshlong-attic/springone-2024-goodbye-passwords

Goodbye, Passwords

preflight

demo