10. Spring Security OAuth2

• spring-boot-starter-oauth2-client — 클라이언트 관점에서 OAuth2.0 인증 처리를 처리할 수 있도록 도와줌

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>

• application.xml 파일에 kakao OAuth2.0 연동을 위한 정보를 입력함
• 카카오 로그인 설정에서 입력한 Redirect URI 주소를 security.oauth2.client.registration.kakao.redirect-uri 부분에 입력함
• 카카오 로그인 설정에서 입력한 Redirect URI 주소의 마지막 부분은 {registrationId} 변수로 처리함

spring:
	security:
	    oauth2:
	      client:
	        registration:
	          kakao:
	            client-name: kakao
	            client-id: 19f4f13148900bb3bedeb7c4eff31e31
	            client-secret: NwhWWnB5D62JcSFRzX3zUC2sRrgJ0iRd
	            scope: profile_nickname, profile_image
	            redirect-uri: "http://localhost:8080/login/oauth2/code/{registrationId}"
	            authorization-grant-type: authorization_code
	            client-authentication-method: POST
	        provider:
	          kakao:
	            authorization-uri: https://kauth.kakao.com/oauth/authorize
	            token-uri: https://kauth.kakao.com/oauth/token
	            user-info-uri: https://kapi.kakao.com/v2/user/me
	            user-name-attribute: id

• 카카오 인증이 완료되었을 때 후처리를 담당할 AuthenticationSuccessHandler 인터페이스 구현체 추가
• 카카오 인증이 완료된 사용자가 신규 사용자라면 사용자를 가입 시킴
• 서비스 접근을 위한 JWT 토큰 생성 및 응답
• 아래 코드에서는 단순히 JSON 포맷으로 응답을 생성하지만, 앱 연동을 위해 앱 전용 스킴을 설계하고 데이터를 전달할 수 있음

public class OAuth2AuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {

  private final Logger log = LoggerFactory.getLogger(getClass());

  private final Jwt jwt;

  private final UserService userService;

  public OAuth2AuthenticationSuccessHandler(Jwt jwt, UserService userService) {
    this.jwt = jwt;
    this.userService = userService;
  }

  @Override
  public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws ServletException, IOException {
    if (authentication instanceof OAuth2AuthenticationToken) {
      OAuth2AuthenticationToken oauth2Token = (OAuth2AuthenticationToken) authentication;
      OAuth2User principal = oauth2Token.getPrincipal();
      String registrationId = oauth2Token.getAuthorizedClientRegistrationId();

      User user = processUserOAuth2UserJoin(principal, registrationId);
      String loginSuccessJson = generateLoginSuccessJson(user);
      response.setContentType("application/json;charset=UTF-8");
      response.setContentLength(loginSuccessJson.getBytes(StandardCharsets.UTF_8).length);
      response.getWriter().write(loginSuccessJson);
    } else {
      super.onAuthenticationSuccess(request, response, authentication);
    }
  }

  private User processUserOAuth2UserJoin(OAuth2User oAuth2User, String registrationId) {
    return userService.join(oAuth2User, registrationId);
  }

  private String generateLoginSuccessJson(User user) {
    String token = generateToken(user);
    log.debug("Jwt({}) created for oauth2 login user {}", token, user.getUsername());
    return "{\"token\":\"" + token + "\", \"username\":\"" + user.getUsername() + "\", \"group\":\"" + user.getGroup().getName() + "\"}";
  }

  private String generateToken(User user) {
    return jwt.sign(Jwt.Claims.of(user.getUsername(), new String[]{"ROLE_USER"}));
  }

}

@Service
public class UserService {

  // ... 생략 ...

  @Transactional
  public User join(OAuth2User oauth2User, String provider) {
    checkArgument(oauth2User != null, "oauth2User must be provided.");
    checkArgument(isNotEmpty(provider), "authorizedClientRegistrationId must be provided.");

    String providerId = oauth2User.getName();
    return findByProviderAndProviderId(provider, providerId)
      .map(user -> {
        log.warn("Already exists: {} for (provider: {}, providerId: {})", user, provider, providerId);
        return user;
      })
      .orElseGet(() -> {
        Map<String, Object> attributes = oauth2User.getAttributes();
        @SuppressWarnings("unchecked")
        Map<String, Object> properties = (Map<String, Object>) attributes.get("properties");
        checkArgument(properties != null, "OAuth2User properties is empty");

        String nickname = (String) properties.get("nickname");
        String profileImage = (String) properties.get("profile_image");
        Group group = groupRepository.findByName("USER_GROUP")
          .orElseThrow(() -> new IllegalStateException("Could not found group for USER_GROUP"));
        return userRepository.save(
          new User(nickname, provider, providerId, profileImage, group)
        );
      });
  }

}

• Spring Security 설정
• OAuth2AuthenticationSuccessHandler Bean 추가 및 설정

@Bean
public OAuth2AuthenticationSuccessHandler oauth2AuthenticationSuccessHandler(Jwt jwt, UserService userService) {
  return new OAuth2AuthenticationSuccessHandler(jwt, userService);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
  http
    // ... 생략 ...
    .oauth2Login()
      .successHandler(getApplicationContext().getBean(OAuth2AuthenticationSuccessHandler.class))
      .and()
    .addFilterAfter(
      getApplicationContext().getBean(JwtAuthenticationFilter.class),
      SecurityContextPersistenceFilter.class
    )
  ;
}