In this election, let's try to set up a resource server which exposes some restabilize in a secure
manner, so that only authenticated and authorized users can invoke them to get details about o'collins
transactions, loans and cards, etc.
We can also discuss how to establish a link between resource server and key club server so that my resource
server can interact with the key.
Glock's over to check the validity of an access token provided by client applications.
So as you can see here, I've created a Mavin project with the name resource.
So what?
First, I will check what kind of dependencies that we have inside Baumgart XML.
So don't worry what our source code that we are going to discuss inside this lecture.
I'm going to upload to this video so that you can download and explore it based upon your convenience.
So as you can see here, my bombed out XML, the very first dependency that I have is springboard startup
data Jipé.
And the very next important dependency that I want to highlight is since my application has to act only
as a resource.
So I have to add a dependency springboard starter or to resource somewhat.
So this indicates to my spring and spring boot application that this is then a resource server which
is trying to leverage or to framework.
And next, we have other dependencies like springboard starter Web Springboard Tools.
So Springboard Tools is a dependency which will help me in reflecting my core changes without restarting
the server manually.
So internally, my springboard dirtballs.
Whenever I make a change, it will detect what gender haban.
And it will deploy only that change and stop deploying the entire application.
So with the help of springboard tools you are, restarts and deployments will be super fast.
So this just an advantage to this project.
But without this dependency, also your project should work.
But in order to reflect your changes, you should be doing manual restarts and deployments.
And the next dependencies that I have added is internal hedge to database.
So in this project, I don't want to use any dedicated excusal database.
Instead, I want to use internal had strewed database to stored my data.
So this is one of the way also that you can do inside springboard applications whenever you're doing
Pewsey.
Since we already done previously by storing the data into a dedicated cloud database like MySQL database.
So here I want to show you a different approach.
So that's why here I'm adding an extra database to store all our details internally without the need
of maintaining a database separately.
And at last, we have a springboard startup test, which is used for unit testing.
So once all these dependencies are added, you can go and open the MainSpring boot application with
the name resource server application.
You can see there is nothing fancy, you know, about springboard application.
We also did the similar annotations for projects that we developed in the previous sections, like component
scan will scan all the controllers configurations during startup and enable GP repositories will enable
all the repositories that we have inside our project so that we can interact with a database and fetch
that data and entities can.
We used to scan the entities or models associated to your database table that we have inside our project.
So once this is done, if you go and absol we have a conflict class where we maintain project security
config, I'll come to that package and class.
Apart from that, everything is very similar to what we have discussed our developer previously.
So there are individual controllers like account controller, balance controller cards, loans, Ganpat
Northe says.
So these controllers exposes the EPA's inside them.
And there are model classes like Akorn Cards, which supports these APUs.
And similarly, we have a GP repository like accounts, repository, cards, repository.
So there is nothing new that I have built here.
Just that I have cleaned all spring security framework related to code like inside this project.
You don't see any authentication provider or password and or any database interaction to validate my
user credentials, like Lordi, user by name.
So all those methods I'm not using anyway.
I will just rely on my geek locks over to do authentication and authorization.
So before I show you what is present inside project security config, let me show you a current controller,
which is one of the sample implementation.
You can see here, there is an API, my account, which is exposed by.
Is controller, what it will do is it will take the email details that are sent in that request based
upon the email.
It will load all the accounts present in the database and give it to the user.
But in order to invoke this API, someone has to pass authentication and authorization.
So how do we enforce that?
Security is with the help of spring security configurations in, say, the class project security config.
As you know, we have to extend Web security configurator.
And Veneri, you extend this class.
We had to override the method configure where we can mention our custom requirements on how we want
to protect our resources.
Incitec, resource somewhat faster lines and come to that.
But before that, you know what?
I'm doing a course configuration.
But this class configuration is more for the UI application that is exposed by Angular app.
And next, I'm seeing every request has to be authorized.
And especially if the API is matching my account, the individual or the client application should have
a role of user.
And similarly, I made for my balance it has to be admin and for loans.
There is no restriction around rules and authorities.
But the user are client application has to be authenticated.
So that way, I also mention for my cards that the user can be user or admin role.
And for slash user also it has to be authenticated.
Whereas for notices and contact APIs, there is no need of any objection.
Those are permitted to everyone and anyone can invoke without authentication and authorization performed
the and matchers.
I'm saying I don't want any Casares checks to happen.
I want everything related to see Assad if he's disabled, because whenever you incorporate or to framework
inside your application, you are already following yanov industry standards.
Then there is no need of following extra layer of sort of token.
But that's why I'm disabling it.
But if you want to follow, you know how to enable it and how to generate a C, a sort of token based
upon our previous actions, discussions.
And at last, the important configuration that I want to mention is in all the sections that we discussed
previously, we used to configure from log in our history to be basic login.
But here, since I won, my project should act as a resource server.
I need to mention dot or to server.
And I'm telling you, it has to follow JWT token standard.
And since Kikla observer maintains that all the rules detailed inside JWT token I just wrote and custom
JWT authentication converter to convert all the roles present inside my token and pass on to the spring
security framework.
So how that happens is if you go and look at the clock roll converter, which implements a converter
here, I'm just taking the JWT access token that I received from the D clock.
So what?
Inside that JSON object, I look for an key value object with the key real access inside the real access
object.
I will how Rawles defined for a specific user our client application.
So I'm trying to get those roles and appen role, underscore Rolin for them here.
This is because my spring security framework will expect the role prefix to be appended for all of my
roles, like admin and user.
So due to that reason, I'm doing that custom logic inside this convertor.
And as you can see here, has any role will only expect Darroll name without the role, underscore it,
will expect the user are admin.
So internally it will happen, the role underscore and it will try to compare with the given role of
an user is matching with the what configure.
So what I'm trying to say here is my spring security framework will append role and escort to this role.
And it will try to compare what we are getting inside the access token from the key Glock's or what.
And since we did that kind of custom conversion like role and score role name, it will matchers and
your authentication and authorization will happen successfully.
So once you make these configurations inside your project security config.
Now your project will act as an resource server that incorporate auto framework.
And one more change that we have to do is to establish a link between your resource server and keep
Glock's so that.
It can validate back access, can be sued every time we knock to give a proper response to the client
applications.
So in order to establish that link, you don't have to do many changes inside your application.
You just have to go to application dot properties and dimension, a property name which is bring Brinks
security dot org to dot resource, our dot jwt dot J-W K hyphen site hyphen.
You are.
So here you just have to give your key clock and point to all localhost 88 and are followed by riyals.
And this is the real name that you might have created.
So if you go and check our geek clock.
So.
So this is the real that we.
How easy bank though?
The same value I have mentioned.
Protocol openly connects last sites.
So this endpoint overall is almost static, except the value real name, which is easily banked.
So so whenever you want your resource our to connect to different real name, then you have to change
the real name here.
So with this with this single configuration, my resource, our know how to connect to my automation
software, to validate the access token received from the client application and all this configuration
that you see at the top of the file is these are internal hedge to database configurations and telling
what is a database you are.
Since I'm using the hedge to internal memory database, I just have to use these values like you can
see here.
What is a driver class name?
And by default, the internal Hedstrom database user name is Asgeir password is blank, followed by
a how to argue configurations related to what is the dialect that my GPA has to use, which is has to
dialect.
And if needed, we can also have an webcams all enabled for our internal memory database that I'm enabling
and server Barford and mentioning here as and the reason is already the default port, which is 880,
is taken by the key club server.
So the this resource server has to run in a different port due to that is and I have mentioned somewhere
that port and remaining two configurations is just to show you are escuela statements inside your logs
and controls.
So once we make all these configurations related to internal Hedstrom database, we should be good and
we can go ahead and start our resource application.
So let me try to start my resource application by clicking debuggers, Java application.
So now my resource server started successfully at the Port 881.
So let's try to validate whether our configurations working properly or not by trying to invoke one
of the security API without passing any current shools.
So I came to the postman.
I'm trying to invoke the IP in my account by passing the email value of the user.
And if I click send, you can see I'm getting four zero one unauthorized user.
So which means my resource server setup is successfully.
And it is protecting the EPA is based upon the configurations that we have done.
And since I have not passed any authorization details.
So my EPA is giving an error for zero one.
And I forgot to highlight about the data, not a will present inside resource somewhat.
As you know, since we are using internal Hedstrom database.
So every time we restart this resource, so we have to make sure the data and the tables are setting
up properly.
So all of those table details and data details that you want to create now, a server is restarted.
You have to mention inside data that escuela present inside the resources folder.
So the name of the file should be data that is lonely.
So make sure you're following the same naming convention.
So here you can see I was dropping any tables exist for the time, creating all the tables and inserting
that data for those tables.
So this way, I set up my resource server successfully.
I'm making sure that data tables are also created inside my internal Hedstrom database.
I also to start by invoking my account without passing any greenshields or without passing any authentication
and authorization details.
And I got four two zero one error.
So in the next lecture, let's try to explore and how to get the access token from the key blocks over
and pass to resource our.
So that I'll get a proper response from it.
Thank you.
And I'll see you in the next lecture by.