Spring Security aspects of an application
Budget: $30 – $250 CAD
Request details
Business requirements
• Allow a user to register with the application using an oauth2 provider (primary-account) then associate multiple different accounts from the same oauth2 provider (sub-accounts).
• Once the multiple sub-accounts are associated with a single application user, allow the application to access protected resources using the primary-account or any of the sub-accounts without losing the session of the primary-account.
Technical requirements
• Spring boot 2.5.2 or above
• “new” oauth2 Spring stack only
• Front end using Thymeleaf but no expectations that the front end be “pretty” or “polished”. Just enough to provide the security aspects
• The actual oauth2 provider is private but a working example with GitHub will be acceptable.
Deliverables
A Spring Boot application that provides
GitHub authentication and authorization
Register with application
• store GitHub attributes including refresh token in table with custom attributes
• custom attributes - Timezone, country
Login
• Only accept login from registered users. Non-registered users are redirected to the register page.
Register sub GitHub account
• Associate additional GitHub account with registered account without storing the actual sub-account credentials. Storing the sub-account refresh tokens is anticipated. The user will have the credentials for all sub-accounts available.
Access REST API provided by the application using primary-account and sub-accounts
• SCOPE_read for FindAll foo, SCOPE_write for Create foo, SCOPE_admin for Delete foo
Re-authenticate for sensitive operation
• Force user to re-authorize with GitHub on primary-account and/or sub-accounts
Logout
• Invalidate primary-account session and disallow access with any sub-accounts
Technical review / explanation of application.
Business requirements
• Allow a user to register with the application using an oauth2 provider (primary-account) then associate multiple different accounts from the same oauth2 provider (sub-accounts).
• Once the multiple sub-accounts are associated with a single application user, allow the application to access protected resources using the primary-account or any of the sub-accounts without losing the session of the primary-account.
Technical requirements
• Spring boot 2.5.2 or above
• “new” oauth2 Spring stack only
• Front end using Thymeleaf but no expectations that the front end be “pretty” or “polished”. Just enough to provide the security aspects
• The actual oauth2 provider is private but a working example with GitHub will be acceptable.
Deliverables
A Spring Boot application that provides
GitHub authentication and authorization
Register with application
• store GitHub attributes including refresh token in table with custom attributes
• custom attributes - Timezone, country
Login
• Only accept login from registered users. Non-registered users are redirected to the register page.
Register sub GitHub account
• Associate additional GitHub account with registered account without storing the actual sub-account credentials. Storing the sub-account refresh tokens is anticipated. The user will have the credentials for all sub-accounts available.
Access REST API provided by the application using primary-account and sub-accounts
• SCOPE_read for FindAll foo, SCOPE_write for Create foo, SCOPE_admin for Delete foo
Re-authenticate for sensitive operation
• Force user to re-authorize with GitHub on primary-account and/or sub-accounts
Logout
• Invalidate primary-account session and disallow access with any sub-accounts
Technical review / explanation of application.