Add TenantPerIssuerComponentRegistry and TenantService to how-to guide

Issue gh-663

Author: sjohnr

docs/modules/ROOT/pages/guides/how-to-multitenancy.adoc

@@ -5,6 +5,15 @@
 :docs-dir: ..
 
 This guide shows how to customize Spring Authorization Server to support multiple issuers per host in a multi-tenant hosting configuration.
+The purpose of this guide is to demonstrate a general pattern for building multi-tenant capable components for Spring Authorization Server, which can also be applied to other components to suit your needs.
+
+* xref:guides/how-to-multitenancy.adoc#multi-tenant-define-tenant-identifier[Define the tenant identifier]
+* xref:guides/how-to-multitenancy.adoc#multi-tenant-create-component-registry[Create a component registry]
+* xref:guides/how-to-multitenancy.adoc#multi-tenant-create-components[Create multi-tenant components]
+* xref:guides/how-to-multitenancy.adoc#multi-tenant-add-tenants-dynamically[Add tenants dynamically]
+
+[[multi-tenant-define-tenant-identifier]]
+== Define the tenant identifier
 
 The xref:protocol-endpoints.adoc#oidc-provider-configuration-endpoint[OpenID Connect 1.0 Provider Configuration Endpoint] and xref:protocol-endpoints.adoc#oauth2-authorization-server-metadata-endpoint[OAuth2 Authorization Server Metadata Endpoint] allow for path components in the issuer identifier value, which effectively enables supporting multiple issuers per host.
 
@@ -27,6 +36,25 @@ NOTE: The base URL of the xref:protocol-endpoints.adoc[Protocol Endpoints] is th
 
 Essentially, an issuer identifier with a path component represents the _"tenant identifier"_.
 
+[[multi-tenant-create-component-registry]]
+== Create a component registry
+
+We start by building a simple registry for managing the concrete components for each tenant.
+The registry contains the logic for retrieving a concrete implementation of a particular class using the issuer identifier value.
+
+We will use the following class in each of the delegating implementations below:
+
+.TenantPerIssuerComponentRegistry
+[source,java]
+----
+include::{examples-dir}/main/java/sample/multitenancy/TenantPerIssuerComponentRegistry.java[]
+----
+
+TIP: This registry is designed to allow components to be easily registered at startup to support adding tenants statically, but also supports xref:guides/how-to-multitenancy.adoc#multi-tenant-add-tenants-dynamically[adding tenants dynamically] at runtime.
+
+[[multi-tenant-create-components]]
+== Create multi-tenant components
+
 The components that require multi-tenant capability are:
 
 * xref:guides/how-to-multitenancy.adoc#multi-tenant-registered-client-repository[`RegisteredClientRepository`]
@@ -39,7 +67,7 @@ For each of these components, an implementation of a composite can be provided t
 Let's step through a scenario of how to customize Spring Authorization Server to support 2x tenants for each multi-tenant capable component.
 
 [[multi-tenant-registered-client-repository]]
-== Multi-tenant RegisteredClientRepository
+=== Multi-tenant RegisteredClientRepository
 
 The following example shows a sample implementation of a xref:core-model-components.adoc#registered-client-repository[`RegisteredClientRepository`] that is composed of 2x `JdbcRegisteredClientRepository` instances, where each instance is mapped to an issuer identifier:
 
@@ -75,7 +103,7 @@ include::{examples-dir}/main/java/sample/multitenancy/DataSourceConfig.java[]
 <2> Use a separate H2 database instance using `issuer2-db` as the name.
 
 [[multi-tenant-oauth2-authorization-service]]
-== Multi-tenant OAuth2AuthorizationService
+=== Multi-tenant OAuth2AuthorizationService
 
 The following example shows a sample implementation of an xref:core-model-components.adoc#oauth2-authorization-service[`OAuth2AuthorizationService`] that is composed of 2x `JdbcOAuth2AuthorizationService` instances, where each instance is mapped to an issuer identifier:
 
@@ -91,7 +119,7 @@ include::{examples-dir}/main/java/sample/multitenancy/OAuth2AuthorizationService
 <4> Obtain the `JdbcOAuth2AuthorizationService` that is mapped to the _"requested"_ issuer identifier indicated by `AuthorizationServerContext.getIssuer()`.
 
 [[multi-tenant-oauth2-authorization-consent-service]]
-== Multi-tenant OAuth2AuthorizationConsentService
+=== Multi-tenant OAuth2AuthorizationConsentService
 
 The following example shows a sample implementation of an xref:core-model-components.adoc#oauth2-authorization-consent-service[`OAuth2AuthorizationConsentService`] that is composed of 2x `JdbcOAuth2AuthorizationConsentService` instances, where each instance is mapped to an issuer identifier:
 
@@ -107,7 +135,7 @@ include::{examples-dir}/main/java/sample/multitenancy/OAuth2AuthorizationConsent
 <4> Obtain the `JdbcOAuth2AuthorizationConsentService` that is mapped to the _"requested"_ issuer identifier indicated by `AuthorizationServerContext.getIssuer()`.
 
 [[multi-tenant-jwk-source]]
-== Multi-tenant JWKSource
+=== Multi-tenant JWKSource
 
 And finally, the following example shows a sample implementation of a `JWKSource<SecurityContext>` that is composed of 2x `JWKSet` instances, where each instance is mapped to an issuer identifier:
 
@@ -121,3 +149,17 @@ include::{examples-dir}/main/java/sample/multitenancy/JWKSourceConfig.java[]
 <2> A `JWKSet` instance mapped to issuer identifier `issuer2`.
 <3> A composite implementation of an `JWKSource<SecurityContext>` that uses the `JWKSet` mapped to the _"requested"_ issuer identifier.
 <4> Obtain the `JWKSet` that is mapped to the _"requested"_ issuer identifier indicated by `AuthorizationServerContext.getIssuer()`.
+
+[[multi-tenant-add-tenants-dynamically]]
+== Add Tenants Dynamically
+
+If the number of tenants is dynamic and can change at runtime, defining each `DataSource` as a `@Bean` may not be feasible.
+In this case, the `DataSource` and corresponding components can be registered through other means at application startup and/or runtime.
+
+The following example shows a Spring `@Service` capable of adding tenants dynamically:
+
+.TenantService
+[source,java]
+----
+include::{examples-dir}/main/java/sample/multitenancy/TenantService.java[]
+----

docs/src/main/java/sample/multitenancy/JWKSourceConfig.java

@@ -20,9 +20,7 @@
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
 import java.util.Collections;
-import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
 import java.util.UUID;
 
 import com.nimbusds.jose.KeySourceException;
@@ -35,18 +33,16 @@
 
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
 
 @Configuration(proxyBeanMethods = false)
 public class JWKSourceConfig {
 
 	@Bean
-	public JWKSource<SecurityContext> jwkSource() {
-		Map<String, JWKSet> jwkSetMap = new HashMap<>();
-		jwkSetMap.put("issuer1", new JWKSet(generateRSAJwk()));	// <1>
-		jwkSetMap.put("issuer2", new JWKSet(generateRSAJwk()));	// <2>
+	public JWKSource<SecurityContext> jwkSource(TenantPerIssuerComponentRegistry componentRegistry) {
+		componentRegistry.register("issuer1", JWKSet.class, new JWKSet(generateRSAJwk()));	// <1>
+		componentRegistry.register("issuer2", JWKSet.class, new JWKSet(generateRSAJwk()));	// <2>
 
-		return new DelegatingJWKSource(jwkSetMap);
+		return new DelegatingJWKSource(componentRegistry);
 	}
 
 	// @fold:on
@@ -72,10 +68,11 @@ private static RSAKey generateRSAJwk() {
 	// @fold:off
 
 	private static class DelegatingJWKSource implements JWKSource<SecurityContext> {	// <3>
-		private final Map<String, JWKSet> jwkSetMap;
 
-		private DelegatingJWKSource(Map<String, JWKSet> jwkSetMap) {
-			this.jwkSetMap = jwkSetMap;
+		private final TenantPerIssuerComponentRegistry componentRegistry;
+
+		private DelegatingJWKSource(TenantPerIssuerComponentRegistry componentRegistry) {
+			this.componentRegistry = componentRegistry;
 		}
 
 		@Override
@@ -85,17 +82,7 @@ public List<JWK> get(JWKSelector jwkSelector, SecurityContext context) throws Ke
 		}
 
 		private JWKSet getJwkSet() {
-			if (AuthorizationServerContextHolder.getContext() == null ||
-					AuthorizationServerContextHolder.getContext().getIssuer() == null) {
-				return null;
-			}
-			String issuer = AuthorizationServerContextHolder.getContext().getIssuer();	// <4>
-			for (Map.Entry<String, JWKSet> entry : this.jwkSetMap.entrySet()) {
-				if (issuer.endsWith(entry.getKey())) {
-					return entry.getValue();
-				}
-			}
-			return null;
+			return this.componentRegistry.get(JWKSet.class);	// <4>
 		}
 
 	}

docs/src/main/java/sample/multitenancy/OAuth2AuthorizationConsentServiceConfig.java

@@ -15,9 +15,6 @@
  */
 package sample.multitenancy;
 
-import java.util.HashMap;
-import java.util.Map;
-
 import javax.sql.DataSource;
 
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -28,7 +25,6 @@
 import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsent;
 import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsentService;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
-import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
 
 @Configuration(proxyBeanMethods = false)
 public class OAuth2AuthorizationConsentServiceConfig {
@@ -37,22 +33,25 @@ public class OAuth2AuthorizationConsentServiceConfig {
 	public OAuth2AuthorizationConsentService authorizationConsentService(
 			@Qualifier("issuer1-data-source") DataSource issuer1DataSource,
 			@Qualifier("issuer2-data-source") DataSource issuer2DataSource,
+			TenantPerIssuerComponentRegistry componentRegistry,
 			RegisteredClientRepository registeredClientRepository) {
 
-		Map<String, OAuth2AuthorizationConsentService> authorizationConsentServiceMap = new HashMap<>();
-		authorizationConsentServiceMap.put("issuer1", new JdbcOAuth2AuthorizationConsentService(	// <1>
-				new JdbcTemplate(issuer1DataSource), registeredClientRepository));
-		authorizationConsentServiceMap.put("issuer2", new JdbcOAuth2AuthorizationConsentService(	// <2>
-				new JdbcTemplate(issuer2DataSource), registeredClientRepository));
+		componentRegistry.register("issuer1", OAuth2AuthorizationConsentService.class,
+				new JdbcOAuth2AuthorizationConsentService(	// <1>
+						new JdbcTemplate(issuer1DataSource), registeredClientRepository));
+		componentRegistry.register("issuer2", OAuth2AuthorizationConsentService.class,
+				new JdbcOAuth2AuthorizationConsentService(	// <2>
+						new JdbcTemplate(issuer2DataSource), registeredClientRepository));
 
-		return new DelegatingOAuth2AuthorizationConsentService(authorizationConsentServiceMap);
+		return new DelegatingOAuth2AuthorizationConsentService(componentRegistry);
 	}
 
 	private static class DelegatingOAuth2AuthorizationConsentService implements OAuth2AuthorizationConsentService {	// <3>
-		private final Map<String, OAuth2AuthorizationConsentService> authorizationConsentServiceMap;
 
-		private DelegatingOAuth2AuthorizationConsentService(Map<String, OAuth2AuthorizationConsentService> authorizationConsentServiceMap) {
-			this.authorizationConsentServiceMap = authorizationConsentServiceMap;
+		private final TenantPerIssuerComponentRegistry componentRegistry;
+
+		private DelegatingOAuth2AuthorizationConsentService(TenantPerIssuerComponentRegistry componentRegistry) {
+			this.componentRegistry = componentRegistry;
 		}
 
 		@Override
@@ -80,17 +79,7 @@ public OAuth2AuthorizationConsent findById(String registeredClientId, String pri
 		}
 
 		private OAuth2AuthorizationConsentService getAuthorizationConsentService() {
-			if (AuthorizationServerContextHolder.getContext() == null ||
-					AuthorizationServerContextHolder.getContext().getIssuer() == null) {
-				return null;
-			}
-			String issuer = AuthorizationServerContextHolder.getContext().getIssuer();	// <4>
-			for (Map.Entry<String, OAuth2AuthorizationConsentService> entry : this.authorizationConsentServiceMap.entrySet()) {
-				if (issuer.endsWith(entry.getKey())) {
-					return entry.getValue();
-				}
-			}
-			return null;
+			return this.componentRegistry.get(OAuth2AuthorizationConsentService.class);	// <4>
 		}
 
 	}

docs/src/main/java/sample/multitenancy/OAuth2AuthorizationServiceConfig.java

@@ -15,9 +15,6 @@
  */
 package sample.multitenancy;
 
-import java.util.HashMap;
-import java.util.Map;
-
 import javax.sql.DataSource;
 
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -29,7 +26,6 @@
 import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationService;
 import org.springframework.security.oauth2.server.authorization.OAuth2TokenType;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
-import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
 
 @Configuration(proxyBeanMethods = false)
 public class OAuth2AuthorizationServiceConfig {
@@ -38,22 +34,25 @@ public class OAuth2AuthorizationServiceConfig {
 	public OAuth2AuthorizationService authorizationService(
 			@Qualifier("issuer1-data-source") DataSource issuer1DataSource,
 			@Qualifier("issuer2-data-source") DataSource issuer2DataSource,
+			TenantPerIssuerComponentRegistry componentRegistry,
 			RegisteredClientRepository registeredClientRepository) {
 
-		Map<String, OAuth2AuthorizationService> authorizationServiceMap = new HashMap<>();
-		authorizationServiceMap.put("issuer1", new JdbcOAuth2AuthorizationService(	// <1>
-				new JdbcTemplate(issuer1DataSource), registeredClientRepository));
-		authorizationServiceMap.put("issuer2", new JdbcOAuth2AuthorizationService(	// <2>
-				new JdbcTemplate(issuer2DataSource), registeredClientRepository));
+		componentRegistry.register("issuer1", OAuth2AuthorizationService.class,
+				new JdbcOAuth2AuthorizationService(	// <1>
+						new JdbcTemplate(issuer1DataSource), registeredClientRepository));
+		componentRegistry.register("issuer2", OAuth2AuthorizationService.class,
+				new JdbcOAuth2AuthorizationService(	// <2>
+						new JdbcTemplate(issuer2DataSource), registeredClientRepository));
 
-		return new DelegatingOAuth2AuthorizationService(authorizationServiceMap);
+		return new DelegatingOAuth2AuthorizationService(componentRegistry);
 	}
 
 	private static class DelegatingOAuth2AuthorizationService implements OAuth2AuthorizationService {	// <3>
-		private final Map<String, OAuth2AuthorizationService> authorizationServiceMap;
 
-		private DelegatingOAuth2AuthorizationService(Map<String, OAuth2AuthorizationService> authorizationServiceMap) {
-			this.authorizationServiceMap = authorizationServiceMap;
+		private final TenantPerIssuerComponentRegistry componentRegistry;
+
+		private DelegatingOAuth2AuthorizationService(TenantPerIssuerComponentRegistry componentRegistry) {
+			this.componentRegistry = componentRegistry;
 		}
 
 		@Override
@@ -89,17 +88,7 @@ public OAuth2Authorization findByToken(String token, OAuth2TokenType tokenType)
 		}
 
 		private OAuth2AuthorizationService getAuthorizationService() {
-			if (AuthorizationServerContextHolder.getContext() == null ||
-					AuthorizationServerContextHolder.getContext().getIssuer() == null) {
-				return null;
-			}
-			String issuer = AuthorizationServerContextHolder.getContext().getIssuer();	// <4>
-			for (Map.Entry<String, OAuth2AuthorizationService> entry : this.authorizationServiceMap.entrySet()) {
-				if (issuer.endsWith(entry.getKey())) {
-					return entry.getValue();
-				}
-			}
-			return null;
+			return this.componentRegistry.get(OAuth2AuthorizationService.class);	// <4>
 		}
 
 	}

docs/src/main/java/sample/multitenancy/RegisteredClientRepositoryConfig.java

@@ -15,8 +15,6 @@
  */
 package sample.multitenancy;
 
-import java.util.HashMap;
-import java.util.Map;
 import java.util.UUID;
 
 import javax.sql.DataSource;
@@ -30,15 +28,15 @@
 import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
-import org.springframework.security.oauth2.server.authorization.context.AuthorizationServerContextHolder;
 
 @Configuration(proxyBeanMethods = false)
 public class RegisteredClientRepositoryConfig {
 
 	@Bean
 	public RegisteredClientRepository registeredClientRepository(
 			@Qualifier("issuer1-data-source") DataSource issuer1DataSource,
-			@Qualifier("issuer2-data-source") DataSource issuer2DataSource) {
+			@Qualifier("issuer2-data-source") DataSource issuer2DataSource,
+			TenantPerIssuerComponentRegistry componentRegistry) {
 
 		JdbcRegisteredClientRepository issuer1RegisteredClientRepository =
 				new JdbcRegisteredClientRepository(new JdbcTemplate(issuer1DataSource));	// <1>
@@ -74,18 +72,18 @@ public RegisteredClientRepository registeredClientRepository(
 		// @formatter:on
 		// @fold:off
 
-		Map<String, RegisteredClientRepository> registeredClientRepositoryMap = new HashMap<>();
-		registeredClientRepositoryMap.put("issuer1", issuer1RegisteredClientRepository);
-		registeredClientRepositoryMap.put("issuer2", issuer2RegisteredClientRepository);
+		componentRegistry.register("issuer1", RegisteredClientRepository.class, issuer1RegisteredClientRepository);
+		componentRegistry.register("issuer2", RegisteredClientRepository.class, issuer2RegisteredClientRepository);
 
-		return new DelegatingRegisteredClientRepository(registeredClientRepositoryMap);
+		return new DelegatingRegisteredClientRepository(componentRegistry);
 	}
 
 	private static class DelegatingRegisteredClientRepository implements RegisteredClientRepository {	// <3>
-		private final Map<String, RegisteredClientRepository> registeredClientRepositoryMap;
 
-		private DelegatingRegisteredClientRepository(Map<String, RegisteredClientRepository> registeredClientRepositoryMap) {
-			this.registeredClientRepositoryMap = registeredClientRepositoryMap;
+		private final TenantPerIssuerComponentRegistry componentRegistry;
+
+		private DelegatingRegisteredClientRepository(TenantPerIssuerComponentRegistry componentRegistry) {
+			this.componentRegistry = componentRegistry;
 		}
 
 		@Override
@@ -113,17 +111,7 @@ public RegisteredClient findByClientId(String clientId) {
 		}
 
 		private RegisteredClientRepository getRegisteredClientRepository() {
-			if (AuthorizationServerContextHolder.getContext() == null ||
-					AuthorizationServerContextHolder.getContext().getIssuer() == null) {
-				return null;
-			}
-			String issuer = AuthorizationServerContextHolder.getContext().getIssuer();	// <4>
-			for (Map.Entry<String, RegisteredClientRepository> entry : this.registeredClientRepositoryMap.entrySet()) {
-				if (issuer.endsWith(entry.getKey())) {
-					return entry.getValue();
-				}
-			}
-			return null;
+			return this.componentRegistry.get(RegisteredClientRepository.class);	// <4>
 		}
 
 	}