'Spring Security 5 + OAuth2 + Webflux : authorization success listeners
In 'Spring Security Reference' page, section 5.11 Post Processing Configured Objects introduces the concept of an ObjectPostProcessor where we can configure a filterSecurityPublishAuthorizationSuccess property on FilterSecurityInterceptor.
@EnableWebSecurity
public class ResourceServerConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.anyRequest().authenticated()
.withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {
public <O extends FilterSecurityInterceptor> O postProcess(O fsi) {
fsi.setPublishAuthorizationSuccess(true); //1 This requires JavaX Servlet API
return fsi;
}
});
. . .
}
In my case using this ObjectPostProcessor I'm able to log authorization success using an ApplicationListener.
package org.mycompany.security.reactive.logging;
public class AuthorizationSuccessListener implements ApplicationListener<AuthorizedEvent> {
@Override
public void onApplicationEvent(AuthorizedEvent event) {
// log journals
}
}
. . .
Right now I'm migrating my application to use Spring Webflux (Reactive) instead of RestTemplate (Java Servlet API).
The problem after migrating my code is: the code from Spring Security page requires the Servlet API (error: The type javax.servlet.Filter cannot be resolved. ) on the line with my comment: //1.
The client code is a simple @RestController + @GetMapping using Spring WebClient.
Has anyone been through a situation like this or know another approach?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
