Spring Boot 2 Oauth how to implement Implicit Code Flow - spring

Question

Currently I am in the process of introducing OAuth to my Spring application, but I have not luck to integrate it correctly. I am using Spring Boot 2.
My requirements are:
Authorization and resource server are the same application running on the same server
Implicit, Authorisation Code Grant and Resource owner credentials grant flows need to be supported
The API I want to secure lives under "/api/v1/"
None of the flows is working correctly.. What I achieved so far is based on the tutorial by https://www.devglan.com/spring-security/spring-oauth2-role-based-authorization and this answer: https://stackoverflow.com/a/52386009/4454752
So my AuthorizationServer looks like this:
#Configuration
#EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
private final AuthenticationManager authenticationManager;
#Autowired
public AuthorizationServerConfig(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
#Bean
public JwtAccessTokenConverter accessTokenConverter() {
JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
converter.setSigningKey("as466gf");
return converter;
}
#Bean
public TokenStore tokenStore() {
return new JwtTokenStore(accessTokenConverter());
}
#Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients
.inMemory()
.withClient("my-client-id")
.authorizedGrantTypes("authorization_code", "implicit", "refresh_token", "password")
.authorities("ADMIN")
.scopes("all")
.resourceIds("product_api")
.secret("$2a$10$jfAHmk4szDU/t1qLGlFTLukuBZL0ZHZGUJQICePjjyq6IrLOS934.")
.redirectUris("https://example.com")
.accessTokenValiditySeconds(7200)
.refreshTokenValiditySeconds(7200);
}
#Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
oauthServer
.tokenKeyAccess("permitAll()")
.checkTokenAccess("permitAll()");
}
#Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
endpoints
.authenticationManager(authenticationManager)
.accessTokenConverter(accessTokenConverter());
}
}
Then the ResourceServer
#Configuration
#EnableResourceServer
#Order(2)
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
#Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.resourceId("product_api");
}
#Override
public void configure(HttpSecurity http) throws Exception {
http
.requestMatchers()
.antMatchers("/**")
.and().authorizeRequests()
.antMatchers("/**").permitAll()
.and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
}
}
And last the WebSecurityConfig
#Configuration
#Order(1)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
#Resource(name = "userDetailService")
private UserDetailService userDetailsService;
#Bean
public BCryptPasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
#Override
#Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
#Autowired
public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(encoder());
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/api/v1/**")
.hasAnyRole("ADMIN", "USER").and()
.httpBasic().and().formLogin().and().authorizeRequests().anyRequest().authenticated();
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.userDetailsService(userDetailsService)
.passwordEncoder(encoder());
}
}
My UserDetails and the complete user management is already set up, so no need to change something here.
Now to the use cases.
If access "/oauth/token":
curl --request POST \
--url http://localhost:8080/oauth/token \
--header 'authorization: Basic bXktY2xpZW50Om15LXNlY3JldA==' \
--header 'content-type: application/x-www-form-urlencoded' \
--data 'grant_type=password&username=admin&password=test'
So with the my-client:my-secret I get an response with access token and refresh token. But if I want to use the access token on my API I get Access denied. If I check the token with /oauth/check_token it says that the token is valid.
Same problem if I use "/oauth/authorize" (Implicit Flow). I know that I need the login page from spring, to make it work, that's why I added formLogin() in WebSecurityConfig. But If I query http://localhost:8080/oauth/authorize?response_type=token&client_id=my-client&redirect_uri=https://example.com I get redirected to /login I log in,then get the access token from the redirect url, but again if I use this token I get the 401 error.
The endpoint I want to access is handled by the following controller:
#RestController
#RequestMapping(value = "/api/v1/user")
#CrossOrigin(origins = "*")
public class UserController {
private static final Logger LOGGER = LogManager.getLogger(UserController.class);
public static final String ROLE_USER = "ROLE_USER";
private final AuthenticationFacade authenticationFacade;
private final UserService userService;
#Autowired
public UserController(AuthenticationFacade authenticationFacade,
UserService userService) {
this.authenticationFacade = authenticationFacade;
this.userService = userService;
}
#RequestMapping(value = "/me", method = RequestMethod.GET)
public Optional<User> getCurrentUser() {
LOGGER.info("Requesting /api/v1/user/me");
return userService.findByUsername((String) authenticationFacade.getAuthentication().getPrincipal());
}
}
I am pretty sure that something with the Security configuration is messed up, but I have no idea what it could be. I looked trough a lot of guides online, but I did not find a single one which explained all the authorization code combined. I think it might be a small bug with authenticating the URLs but I have no clue what it could be.
I would be very happy if someone knows an answer for this.

Answer 1

Move your configure() implementation from WebSecurityConfig to Resource Server configure() method as below
http.authorizeRequests()
.antMatchers("/api/v1/**")
.hasAnyRole("ADMIN", "USER")
Rest of the configurations in configure() method are not required