4

I am using a Spring based Auth-Server which creates JWTs.

   clients.jdbc(dataSource())
        .withClient("sampleClientId")
            .authorizedGrantTypes("implicit", "password", "authorization_code", "refresh_token")
            .scopes("read", "write", "foo")
            .autoApprove(false)
            .accessTokenValiditySeconds(3600)
            .redirectUris("xxx","http://localhost:8080/pmt/", "http://localhost:8080/pmt/index.html", "http://localhost:8080/login/oauth2/code/custom")

To secure the access to the Auth-Server I use a WebSecurityConfigurerAdapter:

public class ServerSecurityConfig extends WebSecurityConfigurerAdapter     
{
    @Override
    protected void configure(AuthenticationManagerBuilder auth)
            throws Exception {

        auth.eraseCredentials(false);
        auth.ldapAuthentication() ....;
    }
  ...
}

On client side I have an angular app in which I use angular-oauth2-oidc to implement an implicit flow.

auth.service.ts:

export const authConfig: AuthConfig = {
  loginUrl: 'http://localhost:8080/pmtauth/oauth/authorize',
  redirectUri: 'http://localhost:8080/pmt/',
  clientId: 'sampleClientId',
  scope: 'read write foo',    
  responseType: 'id_token token',
  requireHttps: false,
  showDebugInformation: true,
  tokenEndpoint: 'http://localhost:8080/pmtauth/oauth/token/',
  oidc: false,
};

@Injectable()
export class AuthService {

  constructor(
    private route: ActivatedRoute,
    private http: HttpClient,
    private oauthService: OAuthService) {
      this.oauthService.configure(authConfig);
      this.oauthService.setStorage(sessionStorage);
      this.oauthService.tryLogin();
 }

  login() {
    this.oauthService.initImplicitFlow();
  }

  checkCredentials() {
    if (this.oauthService.getAccessToken() === null) {
      return false;
    }
    return true;
  }

 logout() {
    this.oauthService.logOut();
    location.reload();
  }

...}

app.module.ts:

@NgModule({
  bootstrap: [App],
  declarations: [
    App
  ],
 imports: [ // import Angular's modules
    BrowserModule,
    HttpClientModule,
   RouterModule,
    FormsModule,
    ReactiveFormsModule,
    NgaModule.forRoot(),
    NgbModule.forRoot(),
    OAuthModule.forRoot(),
    PagesModule,
        routing
  ],
  providers: [
    AppState,
    GlobalState,
    AuthService,
    { provide: OAuthStorage, useValue: sessionStorage },
    { provide: HTTP_INTERCEPTORS, useClass: JwtInterceptor, multi: true },
  ]

After calling method initImplicitFlow() the Login-Page of the Auth-Server is displayed. When I enter the correct credentials (in my case LDAP cred.) the redirectUri given by the client is called:

http://localhost:8080/pmt/#access_token=<Token here>
     &token_type=bearer
     &state=lfSUoxuFJdp7O59UNb0gtXQPOOzcIB4ege0GDnPc
     &expires_in=2162
     &organization=usernamempdDr
     &jti=742fed68-5af3-42f5-b0d9-b93433e28ef7

Then the application "redirects" to this page http://localhost:8080/pmt/#.

So I receive a valid token from my Auth-Server as I can see in the URL, but angular-oauth2-oidc does not extract it and put it in the sessionstore. getIdToken, getAccessToken, hasValidIdToken, etc. always return null/false. There are no errors in my logs. I debugged the OAuthService class but callOnTokenReceivedIfExists() or storeAccessTokenResponse() are never called.

Btw: The first time I call authorize - method on my Auth-Server I have to allow every single scope. Is that a normal behaviour for the implicit flow?

Otis Ottington
  • 425
  • 5
  • 17
  • 2
    I recommend trying [this snippet](https://gist.github.com/jeroenheijmans/7dd02574b989084735457e672ae78466) for extra logging, as well as attaching a `.catch(...)` onto the `tryLogin()` call. Additionally, you could also choose and pick parts from [my sample approach](https://github.com/jeroenheijmans/sample-angular-oauth2-oidc-with-auth-guards/blob/3cf6dde02138fb43bf44b984dda2df9bfd4da057/src/app/core/auth.service.ts#L91), which might give you additional debug info to see where in the process things go haywire. – Jeroen May 02 '19 at 11:42
  • @Otis Ottington did you solve your problem? – Charmin Aug 06 '20 at 13:44

0 Answers0