How to Integrate Fabrixly-IDS with Java Spring Boot

This guide walks you through setting up a Java Spring Boot 3 application as an OAuth2 Resource Server to validate JWT Access Tokens issued by Fabrixly-IDS.

🏗️ Architecture Overview

1. Frontend / Client: Authenticates the user with Fabrixly-IDS, retrieves a JWT Access Token, and passes it to Spring Boot via the Authorization: Bearer <token> header.
2. Resource Server (Spring Boot): Receives the token, contacts the Fabrixly-IDS Discovery endpoint to retrieve signing keys, verifies the token's validity, and enforces role-based access control (RBAC).

Step 1: Add Dependencies

Add the Spring Security OAuth2 Resource Server starter to your pom.xml (Maven):

<dependencies>
    <!-- Web Starter -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <!-- Spring Security & OAuth2 Resource Server -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
    </dependency>
</dependencies>

Step 2: Configure Application Settings

Configure your application properties to point to the Fabrixly-IDS issuer URL. Spring Boot will automatically discover the JWKS endpoint from it.

Create src/main/resources/application.yml:

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://ids.fabrixly.com/oidc

Step 3: Configure Spring Security Filter Chain

Configure Spring Security to act as a Resource Server and require token validation for incoming requests.

Create src/main/java/com/example/config/SecurityConfig.java:

package com.example.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                // Allow health checks publicly
                .requestMatchers("/actuator/**", "/public/**").permitAll()
                // All other requests require a valid JWT token
                .anyRequest().authenticated()
            )
            // Configure resource server to validate incoming Bearer tokens
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> {})
            );
        
        return http.build();
    }
}

Step 4: Implement a Protected Controller

Create a controller that returns data matching the active user details parsed from the JWT.

Create src/main/java/com/example/controller/ApiController.java:

package com.example.controller;

import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

@RestController
@RequestMapping("/api")
public class ApiController {

    @GetMapping("/protected")
    public Map<String, Object> getProtectedData(@AuthenticationPrincipal Jwt jwt) {
        Map<String, Object> response = new HashMap<>();
        
        response.put("status", "success");
        response.put("message", "Greetings from Java Spring Boot! ☕");
        response.put("userId", jwt.getSubject()); // The unique subject ID from Fabrixly
        response.put("email", jwt.getClaimAsString("email"));
        
        return response;
    }
}

Step 5: Test the Integration

1. Start your Spring Boot application (runs on http://localhost:8080 by default).

Request access with a valid Access Token: Acquire a valid user access token from Fabrixly-IDS, then trigger the API call:

curl -H "Authorization: Bearer <your-user-access-token>" \
  http://localhost:8080/api/protected

Response should display the successful JSON response containing your user ID and greetings.

Request access without a token:

curl -i http://localhost:8080/api/protected

Response should be: 401 Unauthorized.