Spring-boot oauth2 splitting authorization server and resource server

Question

Im trying to split the resource server from the authorization server in spring-boot. I have two different applications that i'm running separately. In the authorization server i can get the bearer token from oauth/token but when i'm trying to get access to the resource(sending the token in header) i'm getting an invalid token error. My intention is to use the InMemoryTokenStore and the bearer token. Can anyone tell me what is wrong in my code?

Authorization Server:

@SpringBootApplication
public class AuthorizationServer extends WebMvcConfigurerAdapter {

  public static void main(String[] args) {
    SpringApplication.run(AuthorizationServer.class, args);
  }

  @Configuration
  @EnableAuthorizationServer
  protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {

  private TokenStore tokenStore = new InMemoryTokenStore();

  @Autowired
  private AuthenticationManager authenticationManager;

  @Override
  public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
      endpoints
        .authenticationManager(authenticationManager)
        .tokenStore(tokenStore);
  }

  @Override
  public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
      security.checkTokenAccess("hasAuthority('ROLE_USER')");
  }

  @Override
  public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
      clients
          .inMemory()
            .withClient("user")
            .secret("password")
            .authorities("ROLE_USER")
            .authorizedGrantTypes("password")
            .scopes("read", "write")
            .accessTokenValiditySeconds(1800);
  }  
}

Resource Server:

@SpringBootApplication 
@RestController
@EnableOAuth2Resource
@EnableWebSecurity
@Configuration
public class ResourceServer extends WebSecurityConfigurerAdapter {



public static void main(String[] args){
     SpringApplication.run(ResourceServer.class, args);
}

@RequestMapping("/")
public String home(){
    return "Hello Resource World!";
}

@Bean
public ResourceServerTokenServices tokenService() {
    RemoteTokenServices tokenServices = new RemoteTokenServices();
    tokenServices.setClientId("user");
    tokenServices.setClientSecret("password");
    tokenServices.setTokenName("tokenName");
    tokenServices.setCheckTokenEndpointUrl("http://localhost:8080/oauth/check_token");
    return tokenServices;
}

@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
    OAuth2AuthenticationManager authenticationManager = new OAuth2AuthenticationManager();
    authenticationManager.setTokenServices(tokenService());
    return authenticationManager;
}

@Configuration
@EnableResourceServer
protected static class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .requestMatchers()
            .antMatchers("/","/home")
            .and()
            .authorizeRequests()
            .anyRequest().access("#oauth2.hasScope('read')");
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        TokenStore tokenStore = new InMemoryTokenStore();
        resources.resourceId("Resource Server");
        resources.tokenStore(tokenStore);
    }
}

Hi, I am also trying to do same thing can you please provide me the references which you are following/followed to setup the project — karthik pamidimarri, Jul 02 '15 at 11:30

score 8 · Accepted Answer · answered Mar 12 '15 at 11:20

8

You have created 2 instances of InMemoryTokenStore. If you want to share tokens between the auth server and resource server they need the same store.

answered Mar 12 '15 at 11:20

Dave Syer

56,583
10
155
143

1

@Dave Syer - So I don't need to create instance of InmemoryTokenStore in my resource server ? – Suleman khan Aug 27 '15 at 21:27
No, that wouldn't help at all would it (all the tokens are stored elsewhere)? – Dave Syer Sep 08 '15 at 09:32
@DaveSyer Is it possible to achieve this, but instead of splitting the 2 servers into 2 applications. Make it all into one application, and have the credentials in app.properties file? – JayC Mar 28 '17 at 15:12
@DaveSyer, Is it correct way to configure `clientId/secret` for resource server to ask user info from oauth server by passing the token (no db store access required in this case)? – Sergii Mar 25 '20 at 12:50

Spring-boot oauth2 splitting authorization server and resource server

1 Answers1

Linked