Secure your API with Spring Data MongoDB and Microsoft EntraID

1
git clone git@github.com:mongodb-developer/java-spring-boot-secure-todo-app.git

1
spring.application.name=todo
2
spring.cloud.azure.active-directory.enabled=true
3
spring.cloud.azure.active-directory.profile.tenant-id=<YOUR-TENANT-ID>
4
spring.cloud.azure.active-directory.credential.client-id=<YOUR-APPLICATION-ID>
5
spring.security.oauth2.client.registration.azure.client-authentication-method=none
6
spring.security.oauth2.resourceserver.jwt.issuer-uri=https://login.microsoftonline.com/<YOUR-TENANT-ID/v2.0
7
server.forward-headers-strategy=framework
8
springdoc.swagger-ui.use-root-path=true
9
springdoc.swagger-ui.oauth.use-pkce-with-authorization-code-grant=true
10
spring.security.oauth2.client.registration.azure.redirect-uri=http:<YOUR-APPLICATION-URL>/swagger-ui/oauth2-redirect.html
11
spring.data.mongodb.uri=<YOUR-MONGODB-CONNECTION-URI>
12
spring.data.mongodb.database=<YOUR-MONGODB-DATABASE>

1
package com.example.todo.model;
2
3
import org.springframework.data.annotation.Id;
4
import org.springframework.data.mongodb.core.mapping.Document;
5
6
@Document
7
public class Todo {
8
    @Id
9
    private String id;
10
	private String title;
11
    private boolean completed;
12
13
    // Constructors, getters, and setters
14
}

1
package com.example.todo.model.repository;
2
3
import com.example.todo.model.Todo;
4
import org.springframework.data.mongodb.repository.MongoRepository;
5
6
public interface TodoRepository extends MongoRepository<Todo, String> {
7
}

1
package com.example.todo.service;
2
3
import org.springframework.beans.factory.annotation.Autowired;
4
import org.springframework.stereotype.Service;
5
6
import com.example.todo.model.Todo;
7
import com.example.todo.model.repository.TodoRepository;
8
9
import java.util.List;
10
import java.util.Optional;
11
12
@Service
13
public class TodoService {
14
15
private final TodoRepository todoRepository;
16
17
    public TodoService(TodoRepository todoRepository) {
18
        this.todoRepository = todoRepository;
19
    }
20
21
    public List<Todo> findAll() {
22
        return todoRepository.findAll();
23
    }
24
25
    public Optional<Todo> findById(String id) {
26
        return todoRepository.findById(id);
27
    }
28
29
    public Todo save(Todo todo) {
30
        return todoRepository.save(todo);
31
    }
32
33
    public void deleteById(String id) {
34
        todoRepository.deleteById(id);
35
    }
36
}

1
package com.example.todo.controller;
2
3
import com.example.todo.model.Todo;
4
import com.example.todo.sevice.TodoService;
5
6
import org.springframework.beans.factory.annotation.Autowired;
7
import org.springframework.security.access.prepost.PreAuthorize;
8
import org.springframework.security.core.Authentication;
9
import org.springframework.web.bind.annotation.*;
10
import java.util.List;
11
12
@CrossOrigin(origins = "*")
13
@RestController
14
@RequestMapping("/api/todos")
15
public class TodoController {
16
17
    public TodoController(TodoService todoService) {
18
        this.todoService = todoService;
19
    }
20
21
    @GetMapping
22
    public List<Todo> getAllTodos() {
23
        return todoService.findAll();
24
    }
25
26
    @GetMapping("/{id}")
27
    public Todo getTodoById(@PathVariable String id) {
28
        return todoService.findById(id).orElse(null);
29
    }
30
31
    @PostMapping
32
    @PreAuthorize("hasAuthority('SCOPE_Todo.User')")
33
    public Todo createTodo(@RequestBody Todo todo, Authentication authentication) {
34
        return todoService.save(todo);
35
    }
36
37
    @PutMapping("/{id}")
38
    @PreAuthorize("hasAuthority('SCOPE_Todo.User')")
39
    public Todo updateTodo(@PathVariable String id, @RequestBody Todo todo) {
40
        return todoService.save(todo);
41
    }
42
43
    @DeleteMapping("/{id}")
44
    @PreAuthorize("hasAuthority('SCOPE_Todo.Admin')")
45
    public void deleteTodo(@PathVariable String id) {
46
        todoService.deleteById(id);
47
    }
48
}

1
package com.example.todo.config;
2
3
import io.swagger.v3.oas.models.Components;
4
import io.swagger.v3.oas.models.OpenAPI;
5
import io.swagger.v3.oas.models.info.Info;
6
import io.swagger.v3.oas.models.security.OAuthFlow;
7
import io.swagger.v3.oas.models.security.OAuthFlows;
8
import io.swagger.v3.oas.models.security.Scopes;
9
import io.swagger.v3.oas.models.security.SecurityScheme;
10
11
import org.springframework.beans.factory.annotation.Value;
12
import org.springframework.context.annotation.Bean;
13
import org.springframework.context.annotation.Configuration;
14
15
16
@Configuration
17
class OpenApiConfiguration {
18
	
19
	@Value("${spring.cloud.azure.active-directory.profile.tenant-id}")
20
    private String tenantId;
21
22
    @Bean
23
    OpenAPI customOpenAPI() {
24
        OAuthFlow authorizationCodeFlow = new OAuthFlow();
25
        authorizationCodeFlow.setAuthorizationUrl(String.format("https://login.microsoftonline.com/%s/oauth2/v2.0/authorize", tenantId));
26
        authorizationCodeFlow.setRefreshUrl(String.format("https://login.microsoftonline.com/%s/oauth2/v2.0/token", tenantId));
27
        authorizationCodeFlow.setTokenUrl(String.format("https://login.microsoftonline.com/%s/oauth2/v2.0/token", tenantId));
28
        authorizationCodeFlow.setScopes(new Scopes()
29
        		.addString("api://todo/Todo.User", "Access todo as a user")
30
        		.addString("api://todo/Todo.Admin", "Access todo as an admin"));
31
        OAuthFlows oauthFlows = new OAuthFlows();
32
        oauthFlows.authorizationCode(authorizationCodeFlow);
33
        SecurityScheme securityScheme = new SecurityScheme();
34
        securityScheme.setType(SecurityScheme.Type.OAUTH2);
35
        securityScheme.setFlows(oauthFlows);
36
        return new OpenAPI()
37
            .info(new Info().title("RESTful APIs for Todo"))
38
            .components(new Components().addSecuritySchemes("Microsoft Entra ID", securityScheme));
39
    }
40
}

1
package com.example.todo.config;
2
3
import org.springframework.context.annotation.Bean;
4
import org.springframework.context.annotation.Configuration;
5
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
6
import org.springframework.security.web.SecurityFilterChain;
7
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
8
9
10
@Configuration
11
public class WebConfig {
12
    
13
	@Bean
14
	public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
15
	    http.csrf(AbstractHttpConfigurer::disable);
16
	    return http.build();
17
	}
18
}