Implement Okta in Spring Boot with Spring Security and OAuth 2.0

Integrating Okta with Spring Boot to handle authentication and authorization using Spring Security and OAuth 2.0 can streamline your security processes. This guide provides a detailed explanation of Okta, Spring Security, and OAuth 2.0, along with a real-world code example and an in-depth look at their internal workings.

What is Okta?

Layman Explanation: Okta is like a secure gatekeeper for your online applications. It checks who you are and what you’re allowed to do, making sure only the right people get in and access the right stuff.

Technical Explanation: Okta is an Identity-as-a-Service (IDaaS) platform that provides secure identity management with Single Sign-On (SSO), Multi-Factor Authentication (MFA), and lifecycle management for users. It integrates seamlessly with applications to provide authentication and authorization services.

What is OAuth 2.0?

Layman Explanation: OAuth 2.0 is like giving someone a key that only opens certain doors at your house. It lets apps access some of your data without giving them your password.

Technical Explanation: OAuth 2.0 is an authorization framework that enables applications to obtain limited access to user accounts on an HTTP service, such as Facebook, GitHub, or Okta. It works by delegating user authentication to the service that hosts the user account and authorizing third-party applications to access the user account.

Integrating Okta with Spring Boot and Spring Security

Spring Security is a powerful and customizable authentication and access control framework for Java applications. By integrating Okta and Spring Security with OAuth 2.0, you can manage authentication and authorization in a standardized and secure manner.

1. Set Up Okta Developer Account

Sign up for a free Okta developer account at Okta Developer.
Create a new application in the Okta dashboard:
- Go to Applications > Add Application.
- Choose Web and click Next.
- Set the following parameters:
  - Login redirect URIs: http://localhost:8080/login/oauth2/code/okta
  - Logout redirect URIs: http://localhost:8080
Note down the Client ID and Client Secret from the Okta dashboard.

2. Create a Spring Boot Application

Create a new Spring Boot application using Spring Initializr with the following dependencies:

Spring Web
Spring Security
OAuth2 Client

3. Configure Application Properties

Add the following properties to your application.yml or application.properties file to configure Okta:

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: <your-client-id>
            client-secret: <your-client-secret>
            scope: openid, profile, email
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        provider:
          okta:
            issuer-uri: https://{yourOktaDomain}/oauth2/default

4. Configure Security

Create a security configuration class to handle OAuth 2.0 login with Okta:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter;
import org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter;

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
                .oauth2Login()
                .loginPage("/login")
                .defaultSuccessURL("/dashboard")
                .failureURL("/login?error=true")
                .userInfoEndpoint()
                .oidcUserService(this.oidcUserService());
    }

    @Bean
    public OidcUserService oidcUserService() {
        return new OidcUserService();
    }
}

In this configuration

HttpSecurity is used to configure web-based security for specific HTTP requests.
The oauth2Login() method configures OAuth 2.0 login support.
The OidcUserService bean is used to handle OIDC user information.

5. Create a Controller

Create a controller to handle the login and dashboard pages:

import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;

@Controller
public class HomeController {

    @GetMapping("/")
    public String home() {
        return "home";
    }

    @GetMapping("/dashboard")
    public String dashboard(Model model, @AuthenticationPrincipal OidcUser principal) {
        model.addAttribute("name", principal.getName());
        return "dashboard";
    }
}

Internal Working of OAuth 2.0 with Spring Security and Okta

Client Registration: Spring Security registers the client application with Okta using the provided Client ID and Client Secret.
Authorization Request: When a user tries to access a protected resource, Spring Security redirects the user to Okta's authorization endpoint.
User Authentication: The user authenticates with Okta (e.g., entering username and password).
Authorization Response: Okta sends an authorization code back to the application.
Token Exchange: Spring Security exchanges the authorization code for an access token, ID token, and refresh token from Okta.
UserInfo Endpoint: Spring Security fetches user information from Okta's UserInfo endpoint using the access token.
Authenticated Session: The user is authenticated, and the application creates a session for the user.

Real-World Example

Consider an example where you have a Spring Boot application that requires users to log in with Okta to access a dashboard.

Project Structure

HomeController.java: Handles home and dashboard pages.
SecurityConfig.java: Configures Spring Security and OAuth 2.0.
application.yml: Contains Okta configuration.

Running the Application

Start your Spring Boot application.
Open your browser and navigate to http://localhost:8080.
Click on the login link, which redirects you to Okta for authentication.
After successful authentication, you are redirected back to your application and see the dashboard.

Conclusion

Integrating Okta with Spring Boot and Spring Security using OAuth 2.0 provides a robust and secure way to manage user authentication and authorization. By following this guide, you can implement Okta in your Spring Boot applications, ensuring a seamless and secure user experience. Understanding the internal workings helps you customize and troubleshoot the authentication process effectively.