The objective of this project is to develop a secure simple-service
application using Spring Boot and integrate it with Okta
for authentication and authorization.
Note: In the repository
okta-springboot-react
you can find a more complex example that involves:
- Implementation of a
ReactJS
front-end application and aSpring Boot
back-end application, both secured byOkta
;- Enabling and creating
Okta
groups (a.k.a.ROLES
of the applications).
On ivangfr.github.io, I have compiled my Proof-of-Concepts (PoCs) and articles. You can easily search for the technology you are interested in by using the filter. Who knows, perhaps I have already implemented a PoC or written an article about what you are looking for.
- [Medium] Implementing and Securing a Simple Spring Boot REST API with Okta
- [Medium] Implementing and Securing a Simple Spring Boot UI (Thymeleaf + RBAC) with Okta
- [Medium] Implementing and Securing a Spring Boot GraphQL API with Okta
- [Medium] Building a Single Spring Boot App with Keycloak or Okta as IdP: Introduction
-
Spring Boot
Web Java application offers a user interface (UI) that requires users to log in using theirOkta
accounts. After successful login, users can access and view both their public and private messages.Login Index It also exposes the following endpoints:
Endpoint Description Secured GET /api/private
Retrieve the private message. Only accessible by users that provide a Access Token issued by Okta
YES GET /api/public
Retrieve the public message NO POST /api/callback/token
Used by Okta
to return user's Access TokenNO GET /actuator/*
Used to expose operational information about the application NO
- If you do not have a Developer Edition Account, you can create one at https://developer.okta.com/signup/
- If you already have, access https://developer.okta.com/login/
If you are in Okta Developer Dashboard
home page, click Admin
button on the top-right
The picture below is how Okta Admin Dashboard
looks like
- In the
Okta Admin Dashboard
main menu on the left, clickApplications
menu and thenApplications
sub-menu - In the next page, click
Create App Integration
button - Select
OIDC - OpenID Connect
as Sign on method andWeb Application
as Application type. ClickNext
button - Enter the following values in the form
- General Settings
- App integration name:
Simple Service
- Grant type: besides
Authorization Code
that is already checked, check alsoImplicit (hybrid)
- Sign-in redirect URIs:
https://localhost:8080/login/oauth2/code/okta
andhttps://localhost:8080/api/callback/token
- Sign-out redirect URIs:
https://localhost:8080
- App integration name:
- Assignments
- Controlled access:
Skip group assignment for now
- Controlled access:
- General Settings
- Click
Save
button - The
Client ID
andClient Secret
are generated. - The
Okta Domain
can be obtained by clicking the button-menu present on the up-right corner of the screen.
- In the
Okta Admin Dashboard
main menu on the left, clickDirectory
menu and thenPeople
sub-menu - In the next page, click
Add person
button - Enter the following information
- First name:
Mario
- Last name:
Bros
- Username:
[email protected]
- Primary email:
[email protected]
- Password:
Set by admin
- Set a strong password in the text-field that will appear
Uncheck
the check-box that says "User must change password on first login"
- First name:
- Click
Save
button
- In the
Okta Admin Dashboard
main menu on the left, clickApplications
menu and thenApplications
sub-menu - In the next page, click
Assign Users to App
button - Select the
Simple Service
check-box in the Applications column andMario Bros
check-box in the People column. ClickNext
button to continue assignment process - Click
Confirm Assignments
button
Warning: if we don't do the fix, we will see the following error
{"state":"state","error":"server_error","error_description":"The 'sub' system claim could not be evaluated."}
- In the
Okta Admin Dashboard
main menu on the left, clickApplications
menu and thenApplications
sub-menu - In Applications list whose status are
ACTIVE
, selectSimple Service
application - Click
Assignments
tab - Edit
Mario Bros
by clicking thepen
icon - Set
[email protected]
in theUser Name
text-field - Click
Save
button
-
Open a terminal and make sure you are in
okta-springboot
root folder -
Export the following environment variables. Those values were obtained while adding application in
Okta
.export OKTA_DOMAIN=... export OKTA_CLIENT_ID=... export OKTA_CLIENT_SECRET=...
-
./mvnw clean spring-boot:run --projects simple-service
-
-
Build Docker Image
- JVM
./docker-build.sh
- Native
./docker-build.sh native
- JVM
Environment Variables
Environment Variable Description OKTA_DOMAIN
Specify the Domain
defined by OktaOKTA_CLIENT_ID
Specify the Client ID
defined by OktaOKTA_CLIENT_SECRET
Specify the Client Secret
defined by Okta-
Start Docker Container
docker run --rm --name simple-service -p 8080:8080 \ -e OKTA_DOMAIN=${OKTA_DOMAIN} \ -e OKTA_CLIENT_ID=${OKTA_CLIENT_ID} \ -e OKTA_CLIENT_SECRET=${OKTA_CLIENT_SECRET} \ ivanfranchin/simple-service:1.0.0
-
Application | Type | URL |
---|---|---|
simple-service | UI | https://localhost:8080 |
simple-service | Swagger | https://localhost:8080/swagger-ui.html |
In order to access the simple-service
secured endpoints, you must have a Access Token. Below are the steps to get it.
-
In a terminal, create the following environment variables. Those values were obtained while adding application in
Okta
.OKTA_DOMAIN=... OKTA_CLIENT_ID=...
-
Get Okta Access Token Url
OKTA_ACCESS_TOKEN_URL="https://${OKTA_DOMAIN}/oauth2/default/v1/authorize?\ client_id=${OKTA_CLIENT_ID}\ &redirect_uri=https://localhost:8080/api/callback/token\ &scope=openid\ &response_type=token\ &response_mode=form_post\ &state=state\ &nonce=myNonceValue" echo $OKTA_ACCESS_TOKEN_URL
-
Copy the Okta Access Token Url from the previous step and paste it in a browser
-
The Okta login page will appear. Enter the username & password of the person added at the step
Configuring Okta > Add person
and clickSign In
button -
It will redirect to
api/callback/token
endpoint ofsimple-service
and theAccess token
will be displayed, together with other information{ "state": "state", "access_token": "eyJraWQiOiJyNFdY...", "token_type": "Bearer", "expires_in": "3600", "scope": "openid" }
Note: In jwt.io, you can decode and verify the Access Token
-
GET api/public
The
api/public
endpoint is not secured, so we can call it without any problem.curl -i https://localhost:8080/api/public
It should return
HTTP/1.1 200 It's a public message.
-
GET api/private
without Access TokenTry to call
api/private
endpoint without informing the Access Token.curl -i https://localhost:8080/api/private
It should return
HTTP/1.1 401
-
GET api/private
with Access TokenFirst, get the access token as explained in
Getting Access Token
section. Then, create an environment variable for the access tokenACCESS_TOKEN=...
Call
api/private
endpoint informing the access token.curl -i https://localhost:8080/api/private -H "Authorization: Bearer $ACCESS_TOKEN"
Response
HTTP/1.1 200 [email protected], it's a private message.
-
Get the access token as explained in
Getting Access Token
section. -
Click
Authorize
button. Paste the Access Token in theValue
field. Then, clickAuthorize
andClose
to finalize. -
Done! You can now access the sensitive endpoints.
Go to the terminal where the application is running and press Ctrl+C
In a terminal and inside okta-springboot
root folder, run the command below
./mvnw clean test --projects simple-service
To remove the Docker images created by this project, go to terminal and, inside okta-springboot
root folder, run the following script
./remove-docker-images.sh
- In the
Okta Admin Dashboard
main menu on the left, clickDirectory
menu and thenPeople
sub-menu - Click
Mario Bros
in the People list - In
Mario Bros
profile, clickMore Actions
multi-button and thenDeactivate
- Confirm deactivation by clicking
Deactivate
button - Still in
Mario Bros
profile, clickDelete
button - Confirm deletion by clicking
Delete
button
- In the
Okta Admin Dashboard
main menu on the left, clickApplications
menu and thenApplications
sub-menu - In Application list whose status is
ACTIVE
, clickSimple Service
'sgear
icon and then clickDeactivate
- Confirm deactivation by clicking
Deactivate Application
button - In Application list whose status is
INACTIVE
, clickSimple Service
'sgear
icon and then clickDelete
- Confirm deletion by clicking
Delete Application
button