Add Auto-configuration for RSocket Security

[rwinch]

Spring Boot should autoconfigure RSocket Security

• It should automatically apply @EnableRSocketSecurity
• Conditionally create a MapReactiveUserDetailsService with secure random password as it does for WebFlux
• It should automatically apply Spring Security to ServerRSocketFactory

@Bean
ServerRSocketFactoryCustomizer springSecurityRSocketSecurity(SecuritySocketAcceptorInterceptor interceptor) {
	return builder -> builder.addSocketAcceptorPlugin(interceptor);
}

[rwinch]

Another thing that would be nice for this is if it configured the AuthenticationPrincipalArgumentResolver and the CurrentSecurityContextArgumentResolver. It would look something like this:

@Bean
RSocketMessageHandler messageHandler(RSocketStrategies rSocketStrategies, BeanFactory beanFactory) {
	BeanFactoryResolver resolver = new BeanFactoryResolver(beanFactory);
	AuthenticationPrincipalArgumentResolver principal = new AuthenticationPrincipalArgumentResolver();
	principal.setBeanResolver(resolver);
	CurrentSecurityContextArgumentResolver context = new CurrentSecurityContextArgumentResolver();
	context.setBeanResolver(resolver);
	RSocketMessageHandler messageHandler = new RSocketMessageHandler();
	messageHandler.setRSocketStrategies(rSocketStrategies);
	messageHandler.setRouteMatcher(new PathPatternRouteMatcher());
	ArgumentResolverConfigurer args = messageHandler
							.getArgumentResolverConfigurer();
	args.addCustomResolver(principal);
	args.addCustomResolver(context);
	return messageHandler;
}

Note that RSocketMessageHandler is currently created in RSocketMessagingAutoConfiguration

[bclozel]

@rwinch @rstoyanchev about that last point, there is a way to achieve that in Spring Boot, but it feels a bit unnatural to have that as an opinion expressed for the developers, rather than a use case that could be supported by the configuration infrastructure.

Right now we're supporting most of the configuration through RSocketStrategies but not the argument resolvers. In WebFlux, we have a method for that: WebFluxConfigurer.configureArgumentResolvers(ArgumentResolverConfigurer configurer).

Is there something to be done at the Spring Framework level that would help here?
The alternative in Spring Boot would be to gather HandlerMethodArgumentResolver beans and add them to the RSocketMessageHandler we're creating. Note that this RSocketMessageHandler bean is marked as @ConditionalOnMissingBean so this would not work for developers defining their own.

[rstoyanchev]

It doesn't seem so opinionated to me to have those resolvers applied but on the second point about @ConditoinalOnMissingBean it would indeed be unfortunate to to lose those defaults. Could this be done as part of the @EnableRSocketSecurity setup?

[bclozel]

On the Spring Framework side, we're telling developers to create an RSocketMessageHandler as a bean; this setup is done automatically for Spring Boot users.

I think this could be a two step process:

1. Spring Security should provide those argument resolvers and make it easier for non Spring Boot users to set those up against a custom RSocketMessageHandler
2. Spring Boot could then use this mechanism to auto-configure those resolvers on the RSocketMessageHandler, maybe via another customizer extension point.

[rwinch]

We can expose the argument resolvers as Beans, but this won't be available until Security 5.2.1 since 5.2.0 is out. Perhaps for that reason, I should create another ticket?

[rwinch]

@rstoyanchev I'd like to add...I second @bclozel question:

Is there something to be done at the Spring Framework level that would help here?

In MVC Framework provides WebMvcConfigurer.addArgumentResolvers which allows configuring argument resolvers. In WebFlux Framework provides WebFluxConfigurer.configureArgumentResolvers which allows configuring argument resolvers. For that reason, it is quite surprising that framework doesn't provide something similar for messaging.

[rstoyanchev]

Actually what I had in mind was that Spring Security would use a preProcess hook to find the RSocketMessageHandler bean and access its argumentResolverConfigurer property, and insert those resolves.

The argument resolver options in WebMvc and WebFlux go along with the @Enable annotations, which we don't have for RSocket. I don't think we should keep adding options to RSocketStrategies which currently has some responder-only options but at least is neutral for annotation vs functional programming models.

[rstoyanchev]

As for adding @Enable for RSocket, that is an option, although it would probably be config for 1 bean, or 2 at most. It seemed avoidable at the time.