Accessing my api using google bearer token - spring

Question

I've enabled google auth by defining the following configuration along with the appropriate application.yml file.
#EnableOAuth2Sso
#Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/**")
.authorizeRequests()
.antMatchers("/", "/login**").permitAll()
.anyRequest().authenticated()
.and()
.exceptionHandling()
.authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/"));
}
}
I can access my various endpoints through the browser. But the client might not always be a browser.
I have a controller method defined as below
#GetMapping("/user")
public Principal getUser(Principal principal) {
return principal;
}
From the Principal returned I can see the tokenValue which is of type Bearer. How can I use that against my api? Or another token for that matter. I simply want to access my own api using google auth and oauth.
wget -i http://localhost:8080/user -H "Authorization: Bearer $TOKEN"
Redirects me to the login page.
To clarify a bit more I want to authenticate using google auth but be able to access my api using oauth. Weather it's the token returned by google or one generated by spring doesn't matter. Any clues about how I can make that happen?

Answer 1

You can have a look at spring's tutorial focusing on oauth2, and checkout the github project. They have a nice auth-server project where you can find an exemple of what you want to achieve.
Steps to test your scenario are:
Checkout the tutorial project git clone https://github.com/spring-guides/tut-spring-boot-oauth2.git
Run the spring boot project named auth-server
cd auth-server && mvn spring-boot:run
Authenticate through http://localhost:8080
You'll find out that on auth-server side (the api server), an OAuth2Authentication principal will be available with a bearer token made available. You could use this auth-server exemple to design a Controller returning this token if user is authenticated.
Then you'll be able to wget or curl the auth-server with such requests:
curl -X GET "http://localhost:8080/me" -H "Authorization: Bearer 22e70fcf-eb60-483c-9105-xxxx"
In my tests I got following response: {"name":"674008369426415"}
without the bearer, I fortunately got:
curl -X GET "http://localhost:8080/me"
{"error":"unauthorized","error_description":"Full authentication is required to access this resource"}
Missing parts of code
Looking at your code, I think you're missing the SSO Filter part of the spring's tutorial:
http.antMatcher("/**")
// more configuration here
.addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class);
and
#Bean
public FilterRegistrationBean oauth2ClientFilterRegistration(OAuth2ClientContextFilter filter) {
FilterRegistrationBean registration = new FilterRegistrationBean();
registration.setFilter(filter);
registration.setOrder(-100);
return registration;
}
There must be an interception of client's request somewhere, so this may be something worth looking.