0

Hi I am setting up spring boot Oauth2, for some reason the resource server configs are not being recognised.

I am able to generate the bearer token but when I try to hit any of the url the response is the login page from basic http spring security.

My guess I am missing some backend stuff the spring boot does by default.

I have used similar configs for a normal spring MVC project and it worked. Any pointers as to why this is happening will be helpful.

Like to add one more question spring seems to be finding these config classes earlier we needed to use @Import some one explain how spring does this or links to any documentation will also do.

AppStart.java

@SpringBootApplication(scanBasePackages = { "com.spr.*" })
public class AppStart extends SpringBootServletInitializer {
    public static void main(String[] args) {
        SpringApplication.run(AppStart.class, args);
    }

    @Override
    protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
        return application.sources(AppStart.class);
    }
}

AuthorizationServer.java

@Configuration
@EnableAuthorizationServer
public class AuthorizationServer extends AuthorizationServerConfigurerAdapter {
    @Autowired
    private TokenStore tokenStore;
    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;
    @Autowired
    private DataSource dataSource;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        clients.inMemory().withClient("confidential").secret("secret").authorizedGrantTypes("password").scopes("read",
                "write");

        // clients.jdbc(dataSource);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore).authenticationManager(authenticationManager);
    }

    @Bean
    @Primary
    public DefaultTokenServices tokenServices() {
        DefaultTokenServices tokenServices = new DefaultTokenServices();
        tokenServices.setSupportRefreshToken(true);
        tokenServices.setTokenStore(tokenStore);
        return tokenServices;
    }

}

AppSecurityConfigs.java

@Configuration
    @EnableWebSecurity
    public class AppSecurityConfigs extends WebSecurityConfigurerAdapter {
        @Autowired
        private DataSource dataSource;

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication().withUser("asd").password("asd").authorities("USER");
        }

        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }

        @Bean
        public TokenStore tokenStore() {
            // return new JdbcTokenStore(dataSource);
            return new InMemoryTokenStore();
        }

    }

ResourceServer

@Configuration
@EnableResourceServer
public class ResourceServer extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(final HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/private/**").hasAuthority("USER");
        http.authorizeRequests().anyRequest().permitAll();
    }

    }
SlOtErJaCk
  • 13
  • 9
  • have you disabled spring basic security in your application.yml? – raiyan Jul 18 '17 at 10:12
  • No is it necessary to disable the spring basic security or is there a way to say that the oauth2 filter should come first..something like that – SlOtErJaCk Jul 18 '17 at 11:42
  • You would have to disable spring basic security. That is just a configuration change and simpler. `security.basic.enabled=false` – raiyan Jul 18 '17 at 13:53
  • Thanks Raiyan....It works now and also `security.oauth2.resource.filter-order = 3` config works. Got the above option from another thread [https://stackoverflow.com/questions/42320756/oauth2-with-spring-boot-rest-application-cannot-access-resource-with-token](https://stackoverflow.com/questions/42320756/oauth2-with-spring-boot-rest-application-cannot-access-resource-with-token) – SlOtErJaCk Jul 20 '17 at 04:25

0 Answers0