Configure Spring Zuul to do an OAuth2 "resource owner password grant" for requests with a Basic Authentication header - spring

Question

I have created a very basic Spring Cloud Zuul application to act as a token relay to a resource server. This is extremely simple to do for authorization_code grant. The below does exactly what I need:
package zuul;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.security.oauth2.client.EnableOAuth2Sso;
import org.springframework.cloud.netflix.zuul.EnableZuulProxy;
#SpringBootApplication
#EnableOAuth2Sso
#EnableZuulProxy
public class RelayProxy {
public static void main(String[] args) {
SpringApplication.run(RelayProxy.class, args);
}
}
And in the application.yml (my authorization server runs on port 9999):
server:
port: 8000
security:
oauth2:
client:
accessTokenUri: http://localhost:9999/oauth/token
userAuthorizationUri: http://localhost:9999/oauth/authorize
clientAuthenticationScheme: form
clientId: client
clientSecret: secret
resource:
jwt:
key-uri: http://localhost:9999/oauth/token_key
zuul:
routes:
resource:
path: /resource/**
url: http://localhost:8002/
To allow a legacy system that only supports Basic Authentication to get access to the resource server, I would like a request with a basic authentication header to be intercepted and a password grant performed to obtain and relay the access token. I have tried to configure this using Spring Security / OAuth2 configuration, but was unable to get it to work. The zuul filter below is what I am currently using and it works fine, but I would like to know if it is possible to achieve the same result through the correct Spring configuration:
public class PasswordGrantZuulFilter extends ZuulFilter {
#Value("${security.oauth2.client.accessTokenUri}")
private String accessTokenUri;
#Value("${security.oauth2.client.clientId}")
private String clientId;
#Value("${security.oauth2.client.clientSecret}")
private String clientSecret;
#Autowired
private OAuth2ClientContext clientContext;
#Override
public String filterType() {
return "pre";
}
#Override
public int filterOrder() {
return 10;
}
#Override
public boolean shouldFilter() {
RequestContext ctx = RequestContext.getCurrentContext();
String header = ctx.getRequest().getHeader(HttpHeaders.AUTHORIZATION);
return header != null && header.toLowerCase().startsWith("basic");
}
#Override
public Object run() {
RequestContext ctx = RequestContext.getCurrentContext();
if (clientContext.getAccessToken() == null) {
String header = ctx.getRequest().getHeader(HttpHeaders.AUTHORIZATION);
String base64Credentials = header.substring("Basic".length()).trim();
String credentials = new String(Base64.getDecoder().decode(base64Credentials), Charset.forName("UTF-8"));
final String[] values = credentials.split(":", 2);
HttpHeaders headers = new HttpHeaders();
headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
headers.put(HttpHeaders.AUTHORIZATION, Collections.singletonList("Basic " + Base64.getEncoder().encodeToString((clientId + ":" + clientSecret).getBytes())));
MultiValueMap<String, String> map = new LinkedMultiValueMap<>();
map.add("grant_type", "password");
map.add("username", values[0]);
map.add("password", values[1]);
HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<>(map, headers);
ResponseEntity<OAuth2AccessToken> response = new RestTemplate().postForEntity(accessTokenUri, request, OAuth2AccessToken.class);
clientContext.setAccessToken(response.getBody());
}
ctx.addZuulRequestHeader(HttpHeaders.AUTHORIZATION, OAuth2AccessToken.BEARER_TYPE + " " + clientContext.getAccessToken().getValue());
return null;
}
}