Spring Boot and Multiple Authentication Profiles (None, Password & Okta)
Tags: spring, springboot, okta, security
Published: 2020-07-13 16:02:58

Ahoy Spring user!

Recently, I added Okta login to my application to secure the *admin* section of the website. This is simple enough to accomplish but suddenly I felt the need to run my application locally without any authentication for testing purposes. As I couldn't find any good info on this on the web I decided to share the solution I came up with.

Full source code is here:

{% github trexinc/spring-multi-web-security-config no-readme %}

---

# **A few quick words on setting up Okta authentication**

1. Register for a free developer account at https://developer.okta.com/
2. Create a Spring Boot project with the following [Spring Initialzer settings](https://start.spring.io/#!type=gradle-project&language=java&platformVersion=2.3.1.RELEASE&packaging=jar&jvmVersion=1.8&groupId=example.trexinc&artifactId=multi.web.security.config&name=multi.web.security.config&description=&packageName=example.trexinc.multi.web.security.config&dependencies=web,oauth2-client,thymeleaf,security). 
Dependencies: Spring Web, Spring Security, Thymeleaf & OAuth2 Client.
This solution works specifically **with** OAuth2 Client **and not** the native Okta library.
3. In Okta application configuration change the Login redirect URIs to:
 http://localhost:8080/login/oauth2/code/okta
![Okta configuration](https://dev-to-uploads.s3.amazonaws.com/i/2t28kubue3l27rx3eurs.png)
4. In your *application.properties* configure the following:
{% gist https://gist.github.com/trexinc/c7ab9b08430cfa7c0bae9bd8652c94ad %}
5. And you need to define a Web Security Config to enable Okta authentication:
{% gist https://gist.github.com/trexinc/5d6671a557aa86ece6d6bcfb2dad8272 %}

---

# **Back to the actual point**

To enable several different security profiles I came up with the following solution. We define several Web Security Configurations each with its own `@Profile("ProfileX)` annotation, which enables this profile only when this profile is enabled in Spring.
The code looks likes this:
{% gist https://gist.github.com/trexinc/81e4fec127d5a84cdf6fa4d5b4552190 %}

The relevant *applications.properties* sections look like this (of course only the one you want to use should be enabled, and it should be enabled only at runtime in your CI/CD pipeline):
{% gist https://gist.github.com/trexinc/9ab539956e77a0eddcaf57dd65792152 %}

---

# **What is the best way to run the code locally?**

Once we have the code and know how to make it work one issue remains, what is the best way to run it locally with authentication disabled without modifying the *application.properties* files and risking pushing those modifications to productions.

Two options that I like the most:

1. Configure the relevant Spring profile in InteliJ, go to *"Edit Configurations..."*
![Edit Configurations...](https://dev-to-uploads.s3.amazonaws.com/i/4zdx8tf32xorm24qvczv.png)
And set the profile as *local*
![Set profile](https://dev-to-uploads.s3.amazonaws.com/i/b7j4z87s5754w8ucr53c.PNG)
2. Configure a *bootRun* task in *build.gradle* that will set the profile to local (unless defined otherwise in the environment):
{% gist https://gist.github.com/trexinc/606136d5dc02f464405c3cdf0eb268b2 %}

That's it. Hope you found this useful. Leave comments and likes :)