Simplify configuring authorization server using HttpSecurity.with()

[jgrandja]

This PR attempts to simplify the default configuration for an authorization server using HttpSecurity.with().

We would greatly appreciate if our community users can provide their upvote if you are in favour of:

• the new proposed way of configuring
• keeping with the current way of configuring (as documented in the Getting Started)

Issue gh-1707

[rwinch]

The changes look great to me! Thank you 😄

I think the only thing additional item I'd be looking for is to update the documentation.

• How to use the updated configuration including:
  • A minimal configuration on a single SecurityFilterChain
  • A minimal Multiple FilterChains example
• Is it still recommended to use a multiple SecurityFilterChain's? If so, why (so users can know the tradeoffs of having a single or multiple)? The demonstration of the minimal configuration that is preferred (single/multiple) should be the first config users see in Getting Started.

[jgrandja]

The following sample configuration is the new proposed way of configuring a dedicated authorization server SecurityFilterChain:

@Bean
@Order(1)
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
		throws Exception {

	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer = authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.oidc(Customizer.withDefaults())	// Enable OpenID Connect 1.0
		)
		.authorizeHttpRequests((authorize) ->
			authorize.anyRequest().authenticated()
		)
		// Redirect to the login page when not authenticated from the
		// authorization endpoint
		.exceptionHandling((exceptions) -> exceptions
			.defaultAuthenticationEntryPointFor(
				new LoginUrlAuthenticationEntryPoint("/login"),
				new MediaTypeRequestMatcher(MediaType.TEXT_HTML)
			)
		);

	return http.build();
}

[jgrandja]

The following sample configuration is the current way of configuring a dedicated authorization server SecurityFilterChain (as documented in the Getting Started):

@Bean
@Order(1)
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
		throws Exception {

	OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
	http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
		.oidc(Customizer.withDefaults());	// Enable OpenID Connect 1.0

	http
		// Redirect to the login page when not authenticated from the
		// authorization endpoint
		.exceptionHandling((exceptions) -> exceptions
			.defaultAuthenticationEntryPointFor(
				new LoginUrlAuthenticationEntryPoint("/login"),
				new MediaTypeRequestMatcher(MediaType.TEXT_HTML)
			)
		)
		// Accept access tokens for User Info and/or Client Registration
		.oauth2ResourceServer((resourceServer) -> resourceServer
			.jwt(Customizer.withDefaults()));

	return http.build();
}

[rwinch]

@jgrandja I'm confused why you added these comments. In particular, I'd like to make sure that this was not intended to address my feedback since the feedback was requesting the documentation get updated & comments on the this pull request do not resolve that.

[jgrandja]

@rwinch The reason for updating the comment in the main issue and providing a side-by-side comparison of the new vs. existing sample configuration is to ensure we are truly simplifying the configuration based on feedback from our community users.

The content updates here was triggered from this comment. And then it made me realize that we should validate this proposed enhancement from the community first before we merge this.

Regardless on whether we merge this PR or not, the one thing that is missing in the reference doc is:

Is it still recommended to use a multiple SecurityFilterChain's? If so, why (so users can know the tradeoffs of having a single or multiple)? The demonstration of the minimal configuration that is preferred (single/multiple) should be the first config users see in Getting Started.

I will be adding this content in the reference doc this week.