Spring Authorization Server — OAuth2 인가 서버를 직접 구축하는 방법

┌──────────────┐       ┌────────────────────┐       ┌──────────────┐
│   Client     │──①──▶│  Authorization     │       │  Resource    │
│  (SPA, App)  │◀──②──│  Server (토큰 발급) │       │  Server      │
│              │──────────────③────────────────────▶│  (API 보호)   │
└──────────────┘       └────────────────────┘       └──────────────┘
                              │                            │
                         ④ JWK Set ◀───────────────────────┘
                         (공개키 제공)

// build.gradle
dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-oauth2-authorization-server'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-security'
}

@Configuration
public class AuthorizationServerConfig {

    @Bean
    @Order(1)
    public SecurityFilterChain authServerFilterChain(HttpSecurity http)
            throws Exception {
        // 인가 서버 기본 설정 적용
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);

        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
            .oidc(Customizer.withDefaults()); // OIDC 활성화

        http.exceptionHandling(exceptions ->
            exceptions.defaultAuthenticationEntryPointFor(
                new LoginUrlAuthenticationEntryPoint("/login"),
                new MediaTypeRequestMatcher(MediaType.TEXT_HTML)
            )
        );
        return http.build();
    }

    @Bean
    @Order(2)
    public SecurityFilterChain defaultFilterChain(HttpSecurity http)
            throws Exception {
        // 일반 보안 설정 — 폼 로그인 활성화
        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .formLogin(Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        // 개발용 인메모리 사용자 — 실무에서는 DB 연동
        var user = User.withDefaultPasswordEncoder()
            .username("user").password("password").roles("USER").build();
        return new InMemoryUserDetailsManager(user);
    }
}

@Bean
public RegisteredClientRepository registeredClientRepository() {
    RegisteredClient webClient = RegisteredClient
        .withId(UUID.randomUUID().toString())
        .clientId("web-client")
        .clientSecret("{noop}web-secret") // 실무에서는 반드시 암호화
        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
        .redirectUri("http://localhost:3000/callback")
        .scope(OidcScopes.OPENID)        // OIDC 필수 스코프
        .scope(OidcScopes.PROFILE)
        .scope("read")
        .scope("write")
        .clientSettings(ClientSettings.builder()
            .requireAuthorizationConsent(true)  // 동의 화면 표시
            .requireProofKey(true)              // PKCE 강제
            .build())
        .tokenSettings(TokenSettings.builder()
            .accessTokenTimeToLive(Duration.ofMinutes(30))
            .refreshTokenTimeToLive(Duration.ofDays(7))
            .build())
        .build();

    // 인메모리 저장소 — 실무에서는 JdbcRegisteredClientRepository 사용
    return new InMemoryRegisteredClientRepository(webClient);
}

1. 클라이언트: code_verifier (랜덤 문자열) 생성
2. 클라이언트: code_challenge = SHA256(code_verifier)
3. 클라이언트 → 인가서버: /oauth2/authorize?code_challenge=xxx
4. 사용자: 로그인 + 동의
5. 인가서버 → 클라이언트: redirect_uri?code=AUTH_CODE
6. 클라이언트 → 인가서버: /oauth2/token (code + code_verifier)
7. 인가서버: SHA256(code_verifier) == 저장된 code_challenge 검증
8. 인가서버 → 클라이언트: access_token + refresh_token + id_token

@Bean
public OAuth2TokenCustomizer<JwtEncodingContext> tokenCustomizer() {
    return context -> {
        if (context.getTokenType().getValue().equals("access_token")) {
            Authentication principal = context.getPrincipal();
            // 사용자 권한 정보를 클레임에 추가
            Set<String> authorities = principal.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.toSet());

            context.getClaims().claims(claims -> {
                claims.put("authorities", authorities);
                claims.put("org", "my-company");
            });
        }
    };
}

@Bean
public JWKSource<SecurityContext> jwkSource() {
    KeyPair keyPair = generateRsaKey();
    RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
    RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();

    RSAKey rsaKey = new RSAKey.Builder(publicKey)
        .privateKey(privateKey)
        .keyID(UUID.randomUUID().toString()) // 키 식별자
        .build();

    return new ImmutableJWKSet<>(new JWKSet(rsaKey));
}

private static KeyPair generateRsaKey() {
    try {
        KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");
        gen.initialize(2048); // 최소 2048비트 권장
        return gen.generateKeyPair();
    } catch (Exception ex) {
        throw new IllegalStateException(ex);
    }
}

@Bean
public JwtDecoder jwtDecoder(JWKSource<SecurityContext> jwkSource) {
    return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource);
}

http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
    .authorizationEndpoint(endpoint ->
        endpoint.consentPage("/oauth2/consent") // 커스텀 동의 화면 경로
    )
    .oidc(Customizer.withDefaults());

# 리소스 서버 application.yml
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri: http://localhost:9000/oauth2/jwks

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http)
            throws Exception {
        http.authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasAuthority("ROLE_ADMIN")
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthConverter()))
            );
        return http.build();
    }

    // JWT 클레임에서 권한 정보 추출
    private JwtAuthenticationConverter jwtAuthConverter() {
        var authoritiesConverter = new JwtGrantedAuthoritiesConverter();
        authoritiesConverter.setAuthorityPrefix("");           // 접두사 제거
        authoritiesConverter.setAuthoritiesClaimName("authorities"); // 커스텀 클레임

        var converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
        return converter;
    }
}

@Bean
public OAuth2AuthorizationService authorizationService(
        JdbcTemplate jdbcTemplate,
        RegisteredClientRepository clientRepository) {
    return new JdbcOAuth2AuthorizationService(jdbcTemplate, clientRepository);
}