This service is responsible for: + *
This is a separate module from Commands and Queries services to provide + * security isolation and independent deployment. + */ +@SpringBootApplication +public class AuthServiceApplication { + + public static void main(String[] args) { + SpringApplication.run(AuthServiceApplication.class, args); + } +} diff --git a/test-apps/crypto-trading/auth/src/main/java/org/elasticsoftware/cryptotrading/auth/security/config/SecurityConfig.java b/test-apps/crypto-trading/auth/src/main/java/org/elasticsoftware/cryptotrading/auth/security/config/SecurityConfig.java new file mode 100644 index 00000000..20ce4038 --- /dev/null +++ b/test-apps/crypto-trading/auth/src/main/java/org/elasticsoftware/cryptotrading/auth/security/config/SecurityConfig.java @@ -0,0 +1,143 @@ +/* + * Copyright 2022 - 2025 The Original Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +package org.elasticsoftware.cryptotrading.auth.security.config; + +import org.elasticsoftware.cryptotrading.auth.security.handler.OAuth2LoginFailureHandler; +import org.elasticsoftware.cryptotrading.auth.security.handler.OAuth2LoginSuccessHandler; +import org.elasticsoftware.cryptotrading.auth.security.service.OAuth2UserService; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity; +import org.springframework.security.config.web.server.ServerHttpSecurity; +import org.springframework.security.web.server.SecurityWebFilterChain; +import org.springframework.web.cors.CorsConfiguration; +import org.springframework.web.cors.reactive.CorsConfigurationSource; +import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource; + +import java.util.List; + +/** + * Security configuration for Auth Service. + * + *
This configuration sets up OAuth2 login with Google (and potentially other providers) + * and configures JWT token generation upon successful authentication. + * + *
Key features: + *
CSRF Protection: Disabled because this service generates JWT tokens + * for stateless authentication. CSRF protection is not needed for stateless APIs. + */ +@Configuration +@EnableWebFluxSecurity +public class SecurityConfig { + + private final OAuth2UserService oauth2UserService; + private final OAuth2LoginSuccessHandler successHandler; + private final OAuth2LoginFailureHandler failureHandler; + + /** + * Constructs the security configuration with required dependencies. + * + * @param oauth2UserService the custom OAuth2 user service + * @param successHandler the OAuth2 login success handler + * @param failureHandler the OAuth2 login failure handler + */ + public SecurityConfig( + OAuth2UserService oauth2UserService, + OAuth2LoginSuccessHandler successHandler, + OAuth2LoginFailureHandler failureHandler) { + this.oauth2UserService = oauth2UserService; + this.successHandler = successHandler; + this.failureHandler = failureHandler; + } + + /** + * Configures the security filter chain for OAuth2 authentication. + * + * @param http the server HTTP security configuration + * @return the configured security web filter chain + */ + @Bean + public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) { + http + // CORS configuration for frontend integration + .cors(cors -> cors.configurationSource(corsConfigurationSource())) + + // Authorization rules + .authorizeExchange(exchanges -> exchanges + // Public endpoints + .pathMatchers( + "/actuator/health", + "/actuator/info", + "/.well-known/jwks.json", // JWKS endpoint for JWT validation + "/login/oauth2/**", + "/oauth2/**" + ).permitAll() + // All other endpoints require authentication + .anyExchange().authenticated() + ) + + // OAuth2 login configuration + .oauth2Login(oauth2 -> oauth2 + // Custom user service for Akces integration + .authenticationSuccessHandler(successHandler) + .authenticationFailureHandler(failureHandler) + ); + + return http.build(); + } + + /** + * Configures CORS for development and production environments. + * + *
Development Configuration: Allows all origins, methods, and headers. + * This is acceptable for local development but should be restricted in production. + * + *
Production Configuration: Should restrict: + *
This handler is invoked when OAuth2 authentication fails for any reason, such as: + *
The handler logs the error details and returns a JSON error response to the client. + * + *
The response format is: + *
+ * {
+ * "error": "authentication_failed",
+ * "error_description": "OAuth2 authentication failed: User denied access",
+ * "status": 401
+ * }
+ *
+ */
+@Component
+public class OAuth2LoginFailureHandler implements ServerAuthenticationFailureHandler {
+
+ private static final Logger logger = LoggerFactory.getLogger(OAuth2LoginFailureHandler.class);
+
+ private final ObjectMapper objectMapper;
+
+ /**
+ * Constructs the failure handler with required dependencies.
+ *
+ * @param objectMapper the Jackson object mapper for JSON serialization
+ */
+ public OAuth2LoginFailureHandler(ObjectMapper objectMapper) {
+ this.objectMapper = objectMapper;
+ }
+
+ /**
+ * Handles authentication failure by logging the error and returning an error response.
+ *
+ * @param webFilterExchange the web filter exchange containing the request and response
+ * @param exception the authentication exception that caused the failure
+ * @return a Mono that completes when the response is written
+ */
+ @Override
+ public MonoThis handler is invoked after a user successfully authenticates with an OAuth2 provider. + * It generates both access and refresh tokens and returns them to the client in JSON format. + * + *
The response format is: + *
+ * {
+ * "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
+ * "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
+ * "token_type": "Bearer",
+ * "expires_in": 900
+ * }
+ *
+ *
+ * In production, consider redirecting to a frontend URL with tokens as secure cookies
+ * or URL fragments instead of returning them directly in the response body.
+ */
+@Component
+public class OAuth2LoginSuccessHandler implements ServerAuthenticationSuccessHandler {
+
+ private static final Logger logger = LoggerFactory.getLogger(OAuth2LoginSuccessHandler.class);
+
+ private final JwtTokenProvider jwtTokenProvider;
+ private final ObjectMapper objectMapper;
+
+ /**
+ * Constructs the success handler with required dependencies.
+ *
+ * @param jwtTokenProvider the JWT token provider for generating tokens
+ * @param objectMapper the Jackson object mapper for JSON serialization
+ */
+ public OAuth2LoginSuccessHandler(JwtTokenProvider jwtTokenProvider, ObjectMapper objectMapper) {
+ this.jwtTokenProvider = jwtTokenProvider;
+ this.objectMapper = objectMapper;
+ }
+
+ /**
+ * Handles successful authentication by generating and returning JWT tokens.
+ *
+ * @param webFilterExchange the web filter exchange containing the request and response
+ * @param authentication the authentication object containing user details
+ * @return a Mono that completes when the response is written
+ */
+ @Override
+ public Mono This implementation uses Nimbus JOSE+JWT library with RS256 (RSA Signature with SHA-256)
+ * for asymmetric token signing. The private key is used for signing, and the public key
+ * is distributed via JWKS endpoint for validation by resource servers.
+ *
+ * In production, the private key should come from GCP Service Account credentials.
+ * For development/testing, a generated RSA key pair is used.
+ */
+@Component
+public class JwtTokenProvider {
+
+ private static final Logger logger = LoggerFactory.getLogger(JwtTokenProvider.class);
+
+ private final RsaKeyProvider rsaKeyProvider;
+ private final long accessTokenExpiration;
+ private final long refreshTokenExpiration;
+ private final String issuer;
+ private final JWSSigner signer;
+
+ /**
+ * Constructs a JWT Token Provider with configuration from application properties.
+ *
+ * @param rsaKeyProvider the RSA key provider for signing
+ * @param accessTokenExpiration access token expiration time in milliseconds
+ * @param refreshTokenExpiration refresh token expiration time in milliseconds
+ * @param issuer the issuer claim for JWT tokens
+ */
+ public JwtTokenProvider(
+ RsaKeyProvider rsaKeyProvider,
+ @Value("${app.jwt.access-token-expiration:900000}") long accessTokenExpiration,
+ @Value("${app.jwt.refresh-token-expiration:604800000}") long refreshTokenExpiration,
+ @Value("${app.jwt.issuer:akces-crypto-trading}") String issuer) {
+ this.rsaKeyProvider = rsaKeyProvider;
+ this.accessTokenExpiration = accessTokenExpiration;
+ this.refreshTokenExpiration = refreshTokenExpiration;
+ this.issuer = issuer;
+
+ try {
+ this.signer = new RSASSASigner(rsaKeyProvider.getRsaKey());
+ logger.info("JWT Token Provider initialized with RS256 signing");
+ } catch (JOSEException e) {
+ throw new IllegalStateException("Failed to initialize JWT signer", e);
+ }
+ }
+
+ /**
+ * Generates an access token for the authenticated user.
+ *
+ * @param authentication the authentication object containing user details
+ * @return the generated JWT access token
+ */
+ public String generateAccessToken(Authentication authentication) {
+ OAuth2User oauth2User = (OAuth2User) authentication.getPrincipal();
+
+ String email = oauth2User.getAttribute("email");
+ String name = oauth2User.getAttribute("name");
+ String userId = oauth2User.getAttribute("sub");
+
+ Instant now = Instant.now();
+ Instant expiration = now.plusMillis(accessTokenExpiration);
+
+ return generateToken(userId, email, name, now, expiration, "access");
+ }
+
+ /**
+ * Generates a refresh token for the authenticated user.
+ *
+ * @param authentication the authentication object containing user details
+ * @return the generated JWT refresh token
+ */
+ public String generateRefreshToken(Authentication authentication) {
+ OAuth2User oauth2User = (OAuth2User) authentication.getPrincipal();
+
+ String userId = oauth2User.getAttribute("sub");
+
+ Instant now = Instant.now();
+ Instant expiration = now.plusMillis(refreshTokenExpiration);
+
+ return generateToken(userId, null, null, now, expiration, "refresh");
+ }
+
+ /**
+ * Generates a JWT token with the specified claims using Nimbus JOSE+JWT.
+ *
+ * @param userId the user identifier
+ * @param email the user email (nullable for refresh tokens)
+ * @param name the user name (nullable for refresh tokens)
+ * @param issuedAt the token issuance time
+ * @param expiration the token expiration time
+ * @param tokenType the token type ("access" or "refresh")
+ * @return the generated JWT token
+ */
+ private String generateToken(String userId, String email, String name,
+ Instant issuedAt, Instant expiration,
+ String tokenType) {
+ try {
+ // Create JWT claims
+ JWTClaimsSet.Builder claimsBuilder = new JWTClaimsSet.Builder()
+ .subject(userId)
+ .issuer(issuer)
+ .issueTime(Date.from(issuedAt))
+ .expirationTime(Date.from(expiration))
+ .claim("token_type", tokenType);
+
+ if (email != null) {
+ claimsBuilder.claim("email", email);
+ }
+ if (name != null) {
+ claimsBuilder.claim("name", name);
+ }
+
+ JWTClaimsSet claims = claimsBuilder.build();
+
+ // Create JWT header with key ID
+ JWSHeader header = new JWSHeader.Builder(JWSAlgorithm.RS256)
+ .keyID(rsaKeyProvider.getRsaKey().getKeyID())
+ .build();
+
+ // Create signed JWT
+ SignedJWT signedJWT = new SignedJWT(header, claims);
+ signedJWT.sign(signer);
+
+ return signedJWT.serialize();
+
+ } catch (JOSEException e) {
+ logger.error("Error generating JWT token", e);
+ throw new RuntimeException("Failed to generate JWT token", e);
+ }
+ }
+}
diff --git a/test-apps/crypto-trading/auth/src/main/java/org/elasticsoftware/cryptotrading/auth/security/jwt/RsaKeyProvider.java b/test-apps/crypto-trading/auth/src/main/java/org/elasticsoftware/cryptotrading/auth/security/jwt/RsaKeyProvider.java
new file mode 100644
index 00000000..875ae9af
--- /dev/null
+++ b/test-apps/crypto-trading/auth/src/main/java/org/elasticsoftware/cryptotrading/auth/security/jwt/RsaKeyProvider.java
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2022 - 2025 The Original Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.elasticsoftware.cryptotrading.auth.security.jwt;
+
+import com.nimbusds.jose.jwk.RSAKey;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Component;
+
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.interfaces.RSAPrivateKey;
+import java.security.interfaces.RSAPublicKey;
+import java.util.UUID;
+
+/**
+ * Provides RSA key pair for JWT signing and verification.
+ *
+ * In development/test environments, generates a new RSA key pair on startup.
+ * In production, this should load the GCP Service Account private key from Secret Manager.
+ *
+ * The public key is exposed via JWKS endpoint for JWT validation by resource servers.
+ */
+@Component
+public class RsaKeyProvider {
+
+ private static final Logger logger = LoggerFactory.getLogger(RsaKeyProvider.class);
+
+ private final RSAKey rsaKey;
+
+ /**
+ * Constructs the RSA key provider.
+ * Generates a new 2048-bit RSA key pair for development/testing.
+ *
+ * In production, replace this with loading from GCP Service Account:
+ * This class maps Google-specific attribute names to the standard
+ * {@link OAuth2UserInfo} interface. Google returns user information with
+ * the following attributes:
+ * This interface abstracts OAuth2 user attributes across different providers
+ * (Google, GitHub, Facebook, etc.), allowing the application to work with
+ * user information in a consistent way regardless of the OAuth2 provider.
+ *
+ * Implementations of this interface map provider-specific attribute names
+ * to standard fields like ID, email, and name.
+ */
+public interface OAuth2UserInfo {
+
+ /**
+ * Returns the unique user identifier from the OAuth2 provider.
+ *
+ * @return the user ID
+ */
+ String getId();
+
+ /**
+ * Returns the user's email address.
+ *
+ * @return the email address
+ */
+ String getEmail();
+
+ /**
+ * Returns the user's display name.
+ *
+ * @return the display name
+ */
+ String getName();
+
+ /**
+ * Returns the user's profile image URL.
+ *
+ * @return the image URL, or null if not available
+ */
+ String getImageUrl();
+
+ /**
+ * Returns all raw attributes from the OAuth2 provider.
+ *
+ * @return the attributes map
+ */
+ Map This service is responsible for:
+ * The service integrates with the Akces framework to send CreateAccountCommand
+ * for new users, ensuring that all user accounts are properly registered in the
+ * event-sourced system.
+ */
+@Service
+public class OAuth2UserService extends DefaultReactiveOAuth2UserService {
+
+ private static final Logger logger = LoggerFactory.getLogger(OAuth2UserService.class);
+
+ private final AkcesClient akcesClient;
+
+ /**
+ * Constructs the OAuth2 user service with Akces client integration.
+ *
+ * @param akcesClient the Akces client for sending commands
+ */
+ public OAuth2UserService(AkcesClient akcesClient) {
+ this.akcesClient = akcesClient;
+ }
+
+ /**
+ * Loads the OAuth2 user details after successful authentication with the provider.
+ *
+ * This method:
+ * Note: Account creation is done asynchronously and does not block
+ * the authentication flow. If account creation fails, it is logged but does not prevent
+ * the user from logging in.
+ *
+ * @param userRequest the OAuth2 user request containing tokens and client registration
+ * @return a Mono emitting the OAuth2User with user details
+ * @throws OAuth2AuthenticationException if user details cannot be loaded
+ */
+ @Override
+ public Mono This method sends a CreateAccountCommand to the Akces command bus. In a production
+ * system, you would first check if the account already exists (via a query model lookup)
+ * before attempting to create it.
+ *
+ * TODO: Implement account existence check using AccountQueryModel
+ * to avoid sending duplicate CreateAccountCommand events.
+ *
+ * @param userInfo the OAuth2 user information
+ * @param oauth2User the OAuth2User object
+ * @return a Mono that completes when user processing is done
+ */
+ private Mono This endpoint provides the public keys used for JWT signature verification.
+ * Resource servers (Commands and Queries services) fetch these keys to validate
+ * JWT tokens issued by this Auth service.
+ *
+ * Standard JWKS endpoint: {@code /.well-known/jwks.json}
+ */
+@RestController
+public class JwksController {
+
+ private final RsaKeyProvider rsaKeyProvider;
+
+ /**
+ * Constructs the JWKS controller.
+ *
+ * @param rsaKeyProvider the RSA key provider
+ */
+ public JwksController(RsaKeyProvider rsaKeyProvider) {
+ this.rsaKeyProvider = rsaKeyProvider;
+ }
+
+ /**
+ * Exposes the JWKS endpoint with public keys for JWT verification.
+ *
+ * @return the JSON Web Key Set
+ */
+ @GetMapping(value = "/.well-known/jwks.json", produces = MediaType.APPLICATION_JSON_VALUE)
+ public Mono This configuration validates JWT tokens using Spring Security OAuth2 Resource Server.
+ * JWTs are validated using public keys fetched from the Auth service's JWKS endpoint.
+ *
+ * CSRF Protection: Disabled because this API uses JWT tokens
+ * for stateless authentication. CSRF protection is not needed for stateless APIs
+ * where authentication is via bearer tokens rather than cookies.
+ *
+ * JWT validation is handled automatically by Spring Security using Nimbus JWT library.
+ * No custom authentication code is needed - Spring Security fetches public keys from JWKS
+ * and validates token signatures, expiration, and issuer claims.
+ *
+ * @see Spring Security CSRF
+ */
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+ @Value("${spring.security.oauth2.resourceserver.jwt.jwk-set-uri}")
+ private String jwkSetUri;
+
+ /**
+ * Configures the security filter chain with OAuth2 Resource Server JWT validation.
+ *
+ * @param http the server HTTP security configuration
+ * @return the configured security web filter chain
+ */
+ @Bean
+ public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
+ http
+ // CSRF disabled for stateless JWT-based API (no session cookies)
+ .csrf(csrf -> csrf.disable())
+
+ // Configure OAuth2 Resource Server with JWT
+ .oauth2ResourceServer(oauth2 -> oauth2
+ .jwt(jwt -> jwt.jwtDecoder(jwtDecoder()))
+ )
+
+ // Authorization rules
+ .authorizeExchange(exchanges -> exchanges
+ // Public endpoints
+ .pathMatchers("/actuator/health", "/actuator/info").permitAll()
+ // All other endpoints require authentication
+ .anyExchange().authenticated()
+ );
+
+ return http.build();
+ }
+
+ /**
+ * Creates a reactive JWT decoder using Nimbus that fetches public keys from JWKS endpoint.
+ *
+ * Spring Security automatically:
+ * This configuration overrides the production SecurityConfig to permit all requests
+ * without authentication during testing, allowing existing tests to pass without modification.
+ */
+@TestConfiguration
+public class TestSecurityConfig {
+
+ /**
+ * Configures a permissive security filter chain for tests.
+ *
+ * @param http the server HTTP security configuration
+ * @return the configured security web filter chain
+ */
+ @Bean
+ @Primary
+ public SecurityWebFilterChain testSecurityWebFilterChain(ServerHttpSecurity http) {
+ http
+ .csrf(csrf -> csrf.disable())
+ .authorizeExchange(exchanges -> exchanges
+ .anyExchange().permitAll()
+ );
+
+ return http.build();
+ }
+}
diff --git a/test-apps/crypto-trading/pom.xml b/test-apps/crypto-trading/pom.xml
index 5e211ba3..8fc5c085 100644
--- a/test-apps/crypto-trading/pom.xml
+++ b/test-apps/crypto-trading/pom.xml
@@ -73,6 +73,7 @@
This configuration validates JWT tokens using Spring Security OAuth2 Resource Server.
+ * JWTs are validated using public keys fetched from the Auth service's JWKS endpoint.
+ *
+ * CSRF Protection: Disabled because this API uses JWT tokens
+ * for stateless authentication. CSRF protection is not needed for stateless APIs
+ * where authentication is via bearer tokens rather than cookies.
+ *
+ * JWT validation is handled automatically by Spring Security using Nimbus JWT library.
+ * No custom authentication code is needed - Spring Security fetches public keys from JWKS
+ * and validates token signatures, expiration, and issuer claims.
+ *
+ * @see Spring Security CSRF
+ */
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+ @Value("${spring.security.oauth2.resourceserver.jwt.jwk-set-uri}")
+ private String jwkSetUri;
+
+ /**
+ * Configures the security filter chain with OAuth2 Resource Server JWT validation.
+ *
+ * @param http the server HTTP security configuration
+ * @return the configured security web filter chain
+ */
+ @Bean
+ public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
+ http
+ // CSRF disabled for stateless JWT-based API (no session cookies)
+ .csrf(csrf -> csrf.disable())
+
+ // Configure OAuth2 Resource Server with JWT
+ .oauth2ResourceServer(oauth2 -> oauth2
+ .jwt(jwt -> jwt.jwtDecoder(jwtDecoder()))
+ )
+
+ // Authorization rules
+ .authorizeExchange(exchanges -> exchanges
+ // Public endpoints
+ .pathMatchers("/actuator/health", "/actuator/info").permitAll()
+ // All other endpoints require authentication
+ .anyExchange().authenticated()
+ );
+
+ return http.build();
+ }
+
+ /**
+ * Creates a reactive JWT decoder using Nimbus that fetches public keys from JWKS endpoint.
+ *
+ * Spring Security automatically:
+ * This configuration overrides the production SecurityConfig to permit all requests
+ * without authentication during testing, allowing existing tests to pass without modification.
+ */
+@TestConfiguration
+public class TestSecurityConfig {
+
+ /**
+ * Configures a permissive security filter chain for tests.
+ *
+ * @param http the server HTTP security configuration
+ * @return the configured security web filter chain
+ */
+ @Bean
+ @Primary
+ public SecurityWebFilterChain testSecurityWebFilterChain(ServerHttpSecurity http) {
+ http
+ .csrf(csrf -> csrf.disable())
+ .authorizeExchange(exchanges -> exchanges
+ .anyExchange().permitAll()
+ );
+
+ return http.build();
+ }
+}
+ * ServiceAccountCredentials credentials = ServiceAccountCredentials.fromStream(
+ * new ByteArrayInputStream(serviceAccountJson.getBytes())
+ * );
+ * PrivateKey privateKey = credentials.getPrivateKey();
+ *
+ */
+ public RsaKeyProvider() {
+ try {
+ // Generate RSA key pair for development/testing
+ KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
+ keyPairGenerator.initialize(2048);
+ KeyPair keyPair = keyPairGenerator.generateKeyPair();
+
+ // Create Nimbus RSAKey with key ID
+ this.rsaKey = new RSAKey.Builder((RSAPublicKey) keyPair.getPublic())
+ .privateKey((RSAPrivateKey) keyPair.getPrivate())
+ .keyID(UUID.randomUUID().toString())
+ .build();
+
+ logger.info("Generated RSA key pair for JWT signing (kid: {})", rsaKey.getKeyID());
+ logger.warn("Using generated RSA key pair. In production, load from GCP Service Account.");
+
+ } catch (Exception e) {
+ throw new IllegalStateException("Failed to generate RSA key pair", e);
+ }
+ }
+
+ /**
+ * Gets the RSA key (includes both public and private key).
+ *
+ * @return the RSA key
+ */
+ public RSAKey getRsaKey() {
+ return rsaKey;
+ }
+
+ /**
+ * Gets the public RSA key for JWKS endpoint.
+ *
+ * @return the public RSA key (without private key)
+ */
+ public RSAKey getPublicKey() {
+ return rsaKey.toPublicJWK();
+ }
+}
diff --git a/test-apps/crypto-trading/auth/src/main/java/org/elasticsoftware/cryptotrading/auth/security/model/GoogleOAuth2UserInfo.java b/test-apps/crypto-trading/auth/src/main/java/org/elasticsoftware/cryptotrading/auth/security/model/GoogleOAuth2UserInfo.java
new file mode 100644
index 00000000..9ea49fdb
--- /dev/null
+++ b/test-apps/crypto-trading/auth/src/main/java/org/elasticsoftware/cryptotrading/auth/security/model/GoogleOAuth2UserInfo.java
@@ -0,0 +1,73 @@
+/*
+ * Copyright 2022 - 2025 The Original Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.elasticsoftware.cryptotrading.auth.security.model;
+
+import java.util.Map;
+
+/**
+ * Google OAuth2 user information implementation.
+ *
+ *
+ *
+ *
+ * @see Google OpenID Connect
+ */
+public record GoogleOAuth2UserInfo(Map
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ * @return the JWT decoder
+ */
+ @Bean
+ public ReactiveJwtDecoder jwtDecoder() {
+ return NimbusReactiveJwtDecoder.withJwkSetUri(jwkSetUri).build();
+ }
+}
diff --git a/test-apps/crypto-trading/commands/src/main/resources/application.properties b/test-apps/crypto-trading/commands/src/main/resources/application.properties
index ad17642e..3605129e 100644
--- a/test-apps/crypto-trading/commands/src/main/resources/application.properties
+++ b/test-apps/crypto-trading/commands/src/main/resources/application.properties
@@ -20,4 +20,7 @@ management.endpoint.health.probes.enabled=true
management.health.livenessState.enabled=true
management.health.readinessState.enabled=true
server.shutdown=graceful
-spring.mvc.problemdetails.enabled=true
\ No newline at end of file
+spring.mvc.problemdetails.enabled=true
+
+# OAuth2 Resource Server - JWT validation using JWKS
+spring.security.oauth2.resourceserver.jwt.jwk-set-uri=${JWT_JWK_SET_URI:http://localhost:8080/.well-known/jwks.json}
\ No newline at end of file
diff --git a/test-apps/crypto-trading/commands/src/test/java/org/elasticsoftware/cryptotrading/CryptoTradingCommandApiTest.java b/test-apps/crypto-trading/commands/src/test/java/org/elasticsoftware/cryptotrading/CryptoTradingCommandApiTest.java
index b9c9586e..58d5d418 100644
--- a/test-apps/crypto-trading/commands/src/test/java/org/elasticsoftware/cryptotrading/CryptoTradingCommandApiTest.java
+++ b/test-apps/crypto-trading/commands/src/test/java/org/elasticsoftware/cryptotrading/CryptoTradingCommandApiTest.java
@@ -72,7 +72,10 @@
webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@AutoConfigureWebTestClient
@PropertySource("classpath:akces-aggregateservice.properties")
-@ContextConfiguration(initializers = CryptoTradingCommandApiTest.Initializer.class)
+@ContextConfiguration(
+ initializers = CryptoTradingCommandApiTest.Initializer.class,
+ classes = org.elasticsoftware.cryptotrading.security.config.TestSecurityConfig.class
+)
@Testcontainers
@DirtiesContext
public class CryptoTradingCommandApiTest {
diff --git a/test-apps/crypto-trading/commands/src/test/java/org/elasticsoftware/cryptotrading/security/config/TestSecurityConfig.java b/test-apps/crypto-trading/commands/src/test/java/org/elasticsoftware/cryptotrading/security/config/TestSecurityConfig.java
new file mode 100644
index 00000000..b0b3c02a
--- /dev/null
+++ b/test-apps/crypto-trading/commands/src/test/java/org/elasticsoftware/cryptotrading/security/config/TestSecurityConfig.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2022 - 2025 The Original Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.elasticsoftware.cryptotrading.security.config;
+
+import org.springframework.boot.test.context.TestConfiguration;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Primary;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.web.server.SecurityWebFilterChain;
+
+/**
+ * Test security configuration that disables authentication for integration tests.
+ *
+ *
+ *
+ *
+ * @return the JWT decoder
+ */
+ @Bean
+ public ReactiveJwtDecoder jwtDecoder() {
+ return NimbusReactiveJwtDecoder.withJwkSetUri(jwkSetUri).build();
+ }
+}
diff --git a/test-apps/crypto-trading/queries/src/main/resources/application.properties b/test-apps/crypto-trading/queries/src/main/resources/application.properties
index 5e6056cc..7e8abfd4 100644
--- a/test-apps/crypto-trading/queries/src/main/resources/application.properties
+++ b/test-apps/crypto-trading/queries/src/main/resources/application.properties
@@ -26,4 +26,7 @@ spring.mvc.problemdetails.enabled=true
spring.autoconfigure.exclude=org.springframework.boot.data.jpa.autoconfigure.DataJpaRepositoriesAutoConfiguration
spring.liquibase.change-log=classpath:/db/changelog/db.changelog-master.xml
akces.cryptotrading.counterPartyId=Coinbase
-akces.client.domainEventsPackage=org.elasticsoftware.cryptotrading.aggregates
\ No newline at end of file
+akces.client.domainEventsPackage=org.elasticsoftware.cryptotrading.aggregates
+
+# OAuth2 Resource Server - JWT validation using JWKS
+spring.security.oauth2.resourceserver.jwt.jwk-set-uri=${JWT_JWK_SET_URI:http://localhost:8080/.well-known/jwks.json}
\ No newline at end of file
diff --git a/test-apps/crypto-trading/queries/src/test/java/org/elasticsoftware/cryptotrading/CryptoTradingQueryApiTest.java b/test-apps/crypto-trading/queries/src/test/java/org/elasticsoftware/cryptotrading/CryptoTradingQueryApiTest.java
index 8a933dd6..9b50664a 100644
--- a/test-apps/crypto-trading/queries/src/test/java/org/elasticsoftware/cryptotrading/CryptoTradingQueryApiTest.java
+++ b/test-apps/crypto-trading/queries/src/test/java/org/elasticsoftware/cryptotrading/CryptoTradingQueryApiTest.java
@@ -77,7 +77,10 @@
)
@AutoConfigureWebTestClient
@PropertySource("classpath:akces-aggregateservice.properties")
-@ContextConfiguration(initializers = CryptoTradingQueryApiTest.Initializer.class)
+@ContextConfiguration(
+ initializers = CryptoTradingQueryApiTest.Initializer.class,
+ classes = org.elasticsoftware.cryptotrading.security.config.TestSecurityConfig.class
+)
@Testcontainers
@DirtiesContext
public class CryptoTradingQueryApiTest {
diff --git a/test-apps/crypto-trading/queries/src/test/java/org/elasticsoftware/cryptotrading/security/config/TestSecurityConfig.java b/test-apps/crypto-trading/queries/src/test/java/org/elasticsoftware/cryptotrading/security/config/TestSecurityConfig.java
new file mode 100644
index 00000000..b0b3c02a
--- /dev/null
+++ b/test-apps/crypto-trading/queries/src/test/java/org/elasticsoftware/cryptotrading/security/config/TestSecurityConfig.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2022 - 2025 The Original Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.elasticsoftware.cryptotrading.security.config;
+
+import org.springframework.boot.test.context.TestConfiguration;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Primary;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.web.server.SecurityWebFilterChain;
+
+/**
+ * Test security configuration that disables authentication for integration tests.
+ *
+ *