If you are trying to add authentication to a java web application with springboot, I think this document can help you, it provides a sample on integrating azure ad.
And if you want to make the springboot backend app as an API application(Front and back-end separation), I have an idea that you could use masl.js to achieve login module in front-end application, and the backend app just adding filter to check if the request is consented. I used to write a filter like below.
package com.example.demo;
import java.io.IOException;
import java.util.Arrays;
import java.util.Date;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import com.alibaba.fastjson.JSONObject;
import com.auth0.jwt.JWT;
import com.auth0.jwt.exceptions.JWTDecodeException;
import com.auth0.jwt.interfaces.Claim;
import com.auth0.jwt.interfaces.DecodedJWT;
//@Component
@WebFilter(filterName = "AdHelloFilter", urlPatterns = {"/ad/*"})
public class AdHelloFilter implements Filter {
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
throws IOException, ServletException {
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse= (HttpServletResponse) response;
final String requestTokenHeader = httpRequest.getHeader("Authorization");
if (requestTokenHeader != null && requestTokenHeader.startsWith("Bearer ")) {
String jwtToken = requestTokenHeader.substring(7);
try {
DecodedJWT jwt = JWT.decode(jwtToken);
//judge if expired
Date expiresAt = jwt.getExpiresAt();
if(expiresAt.before(new Date())) {
Map<String, Object> errRes = new HashMap<String, Object>();
Map<String, Object> errMesg = new HashMap<String, Object>();
errMesg.put("code", "InvalidAuthenticationToken");
errMesg.put("message", "Access token has expired.");
errRes.put("error", errMesg);
String json = JSONObject.toJSONString(errRes);
httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, json);
return;
}
//judge if has specific scope
Claim a = jwt.getClaim("scp");
String scope = a.asString();
String[] scopeArr = scope.split(" ");
List<String> scopeList= Arrays.asList(scopeArr);
if(!(scopeList.contains("User.Read") && scopeList.contains("Mail.Read"))) {
Map<String, Object> errRes = new HashMap<String, Object>();
Map<String, Object> errMesg = new HashMap<String, Object>();
errMesg.put("code", "InvalidAuthenticationToken");
errMesg.put("message", "Unauthorized, pls add api permission");
errRes.put("error", errMesg);
String json = JSONObject.toJSONString(errRes);
httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, json);
return;
}
} catch (JWTDecodeException exception){
System.out.println("Unable to Decode the JWT Token");
}
} else {
httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
return;
}
filterChain.doFilter(request, response);
}
@Override
public void init (FilterConfig filterConfig) throws ServletException{
System.out.println("init filter");
}
@Override
public void destroy() {}
}
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
