I've been stuck for a while now. I'm modifying my Spring Security project by adding Jwt. Currently, I'm trying to make the JwtEncoder and JwtDecoder work in SecurityConfig, I need RSAPrivateKey and RSAPublicKey for these methods. To get these Key-values I'm using a Record with @ConfigurationProperties annotation. But Getting this Record into the SecurtyConfig gives me some problems:

***************************
APPLICATION FAILED TO START
***************************

Description:

Parameter 1 of constructor in com.ssl.app.security.config.SecurityConfig required a bean of type 'com.ssl.app.security.config.RsaKeyProperties' that could not be found.


Action:

Consider defining a bean of type 'com.ssl.app.security.config.RsaKeyProperties' in your configuration.

This is my SecurtyConfig

import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
import com.nimbusds.jose.jwk.source.JWKSource;
import com.nimbusds.jose.proc.SecurityContext;
import com.ssl.app.security.filters.LoginAuthFilter;
import com.ssl.app.utility.ConsoleUtil;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;



@Configuration
//@AllArgsConstructor
@EnableWebSecurity
//@EnableConfigurationProperties
public class SecurityConfig {
    private final LoginAuthFilter loginAuthFilter;
    private final RsaKeyProperties rsaKeyProperties;



    public SecurityConfig(LoginAuthFilter loginAuthFilter, RsaKeyProperties rsaKeyProperties) {
        this.loginAuthFilter = loginAuthFilter;
        this.rsaKeyProperties = rsaKeyProperties;
    }



    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .csrf(csrf -> csrf.disable())
                .authorizeRequests(auth -> auth
                        .anyRequest().authenticated()
                )
                .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt) // get config_class :: method
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .addFilterBefore(loginAuthFilter, UsernamePasswordAuthenticationFilter.class)
                .build();
    }



    @Bean
    JwtDecoder jwtDecoder() {
        ConsoleUtil.PrintRow(this.getClass().getSimpleName(),"Decode publicKey", "true");
        // Get public key and decode and return
        return NimbusJwtDecoder.withPublicKey(rsaKeyProperties.publicKey()).build();

    }



    @Bean
    JwtEncoder jwtEncoder() {
        ConsoleUtil.PrintRow(this.getClass().getSimpleName(),"Encode jwt", true);

        JWK jwk = new RSAKey.Builder(rsaKeyProperties.publicKey()).privateKey(rsaKeyProperties.privateKey()).build();
        JWKSource<SecurityContext> jwks = new ImmutableJWKSet<>(new JWKSet(jwk));
        return new NimbusJwtEncoder(jwks);
    }

}

Record

import org.springframework.boot.context.properties.ConfigurationProperties;

import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;

@ConfigurationProperties(prefix ="rsa")
public record RsaKeyProperties(RSAPublicKey publicKey, RSAPrivateKey privateKey) {
}

I tried adding @EnableConfigurationProperties, and EnableAutoConfiguration to the SecurtyConfig would work, but it has no effect. @Value annotation don't work either. The SecurityConfig required a bean, but what bean?

CodePudding user response：

Maybe you should refer to this article spring-security-jwt