Add OAuth2 to existing Spring Security App - spring

Question

I have a web application which runs with following configuration.
public class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/api/**")
.authorizeRequests()
.antMatchers("/api/open/**").permitAll()
.antMatchers("/api/data/**").authenticated()
.antMatchers("/api/user/**").hasRole("USER")
.antMatchers("/api/mgr/**").hasRole("MGR")
.antMatchers("/api/admin/**").hasRole("ADMIN")
.anyRequest().authenticated()
.and() .exceptionHandling().accessDeniedHandler(customBasicAuthenticationAccessDeniedHandler())
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.csrf().disable() //TODO
.httpBasic().authenticationEntryPoint(customBasicAuthenticationEntryPoint());
}
...
}
I then added,
#Configuration
#EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
...
}
and
#Configuration
#EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
//Same as WebSecurityConfigurerAdapter configure()
...
}
Because of ResourceServerConfig class now everything has crewed up. Tried various ways to configure this. But it seems ResourceServerConfigurerAdapter behave completely different than WebSecurityConfigurerAdapter, but I don't have a single clue to get this to work.
Do I need to remove WebSecurityConfigurerAdapter and keep only ResourceServerConfigurerAdapter? Did that, but configure(HttpSecurity) behave differently than I thought.
Also some stackoverflow answers recommended to change the #Order of the WebSecurityConfigurerAdapter. But nothing works.
I need to know actually what is wrong and what is correct first, than writing a code.
Appreciate very very much if someone point me a right direction.
Thanks!

Answer 1

By sharing this, I am only intending to be helpful, not answer your query. I know documentation is not that good. Just sharing my 2 cents.
This is what worked for me. Using Spring-security-Oauth2 version 2.0.7
#EnableWebSecurity
public class SampleMultiHttpSecurityConfig {
#Configuration
#Order(1)
public static class ComplexOauth2SpringSecurityConfiguration extends
WebSecurityConfigurerAdapter {
#Autowired
private OAuth2AuthenticationProcessingFilter oAuth2AuthenticationProcessingFilter;
#Autowired
private OAuth2AuthenticationManager oAuth2AuthenticationManager;
#Override
protected void configure(HttpSecurity http) throws Exception {
...
}
}
#Configuration
public static class ComplexOauth2SpringSecurityConfiguration2 extends
WebSecurityConfigurerAdapter {
#Autowired
private OAuth2AuthenticationProcessingFilter oAuth2AuthenticationProcessingFilter;
#Autowired
private OAuth2AuthenticationManager oAuth2AuthenticationManager;
#Override
protected void configure(HttpSecurity http) throws Exception {
...
}
}
Thereafter, I simply added a component:scan on the package which is having this class.
This is primarily on the server side.
Also, note the injection of OAuth2AuthenticationProcessingFilter. This is based on RemoteTokenServices whose one of many jobs is to perform Token Validation with Authorization server.
<bean id="remoteTokenServices" class="org.springframework.security.oauth2.provider.token.RemoteTokenServices"
init-method="init" destroy-method="shutdown">
<property name="checkTokenEndpointUrl" value"..."/>
</bean>
I do agree that I did not implement resource server and Authorization server. They were already built for us. However, while testing we simply created couple of REST POST services to simulate the Token generation and Validation.