I have created a sample SOAP Web Service project (spring boot) and trying to integrate Okta as a resource server for authentication.
I am able to deploy the application to WebLogic, but when testing the service using SOAP UI, it gives the response even when there is no Token included in the header.
When I access WSDL from a browser using my wsdl url, http://myhost:port/appservice/app.wsdl I see the 401 error, so I think it is picking up the Security config changes. But it is not working for SOAP requests, I would get response even with out Okta token.
Is it because for SOAP requests, do I need to include any interceptors on top of Security Config java file. Or am I taking a wrong path for security with SOAP. Can someone let me know what am I missing or point me to right direction. Is token validation part of WS-Security? or the authentication manager in Okta resource server enough for this?
I followed this documentation to create it.
I have read most of the SO questions related to this and spring documentation, but could not connect the missing dots. Please help me with this. After spending lot of time, I felt like I was moving in circles.
UPDATE:
I have enabled spring security debug logs by doing below
#EnableWebSecurity(debug=true)
logging.level.org.springframework.security.web.FilterChainProxy=DEBUG
UPDATE2:
I haven't made any big changes to my configuration, but when I ran the project on embedded tomcat locally, it started working. To run on Tomcat, I changed packaging from war to jar, excluded Tomcat in my POM and in my Main class, I had to remove the SpringBootServletInitializer and WebApplicationInitializer. That's it. I tested SOAP UI with the Okta bearer token and it gave me response. With out the token it did not give me response.
Spring Security not working only in case of WebLogic12c. I don't know what I am missing to include for that to work in WebLogic. when deployed through Tomcat, request is passed through all the beans in Security Filter Chain {
WebAsyncManagerIntegrationFilter,
SecurityContextPersistenceFilter,
HeaderWriterFilter,
CsrfFilter,
LogoutFilter,
BearerTokenAuthenticationFilter,
RequestCacheAwareFilter,
SecurityContextHolderAwareRequestFilter,
AnonymousAuthenticationFilter,
SessionManagementFilter,
ExceptionTranslationFilter,
FilterSecurityInterceptor}
But on WebLogic, the request is passed only through first four beans in Security Filter Chain {WebAsyncManagerIntegrationFilter,
SecurityContextPersistenceFilter,
HeaderWriterFilter,
CsrfFilter}
I just wanted to update the alternate solution I found for this problem, for completeness.
Spring Security Filter chain was not working for Weblogic, where as same was working in Tomcat, even for Weblogic version 12.2.1.4.
I had followed this example, and implemented Okta filter as spring boot version was not working in Weblogic 12.2.1.4.
Thanks to #Toerktumlare, I have implemented logging with logback-spring.xml
I am trying deploy and run (Spring data) in external tomcat server. Deployment happening without any errors but getting 404 errors when I am trying to hit rest end point. The same rest working fine with out jpa changes. Do we required any data source configuration in external tomcat server in order to run the application. Please provide any reference for the same.
I have an existing spring web application that uses spring-boot-starter-web; I have been planning to introduce reactive into this application. For a new feature that I am working, I have pulled in spring reactive web socket, configured and coded as specified in the spring doc; but unfortunately it does not work (got 404).
I tried a sample application and that works perfectly.
I used this one as my sample application.
I found that the sample application comes up on Netty, not on Tomcat. So I added spring-boot-starter-web to it, got the server to start in Tomcat and got the same 404 as I got in my application.
I also added TomcatRequestUpgradeStrategy unsuccessfully.
should I assume that spring-web and spring-webflux conflict with each other and I should go back to the regular websocket? Please advise.
Spring said that if both spring web and spring webflux present in the classpath; spring web kicks in and reactive websocket won't come up.
More details here: https://github.com/spring-projects/spring-boot/issues/23236
I have created a spring-boot-troubleshooting repo on GitHub that reproduces this error exactly.
I am building a Spring Boot-based REST service that will only be exposing RESTful API endpoints, absolutely no UI/views/HTML pages whatsoever.
You can see in that repo's build.gradle that the only two Spring Boot dependencies I depend on are:
,'org.springframework.boot:spring-boot-starter-jetty'
,'org.springframework.boot:spring-boot-starter-actuator'
So nothing view-related (Thymeleaf, etc.).
When you run that app and open a browser to go to the FizzbuzzResource URL you'll get:
Problem accessing /error. Reason:
Not Found
And then on the console you'll see:
WARN o.s.web.servlet.PageNotFound - No mapping found for HTTP request with URI [/v1/fizzbuzz/12345] in DispatcherServlet with name 'dispatcherServlet'
I'm wondering why Spring is complaining HTML-basedPageNotFound errors when this should be a pure REST service, and of course, I'd love to know what the fix is to get this working and returning my Fizzbuzz resource properly!
You need to enable web mvc and make ApiVersionRequestMappingHandlerMapping a bean in the container otherwise Spring won't use your ApiVersionRequestMappingHandlerMapping#getMappingForMethod.
See my commit https://github.com/yaoReadingCode/spring-boot-troubleshooting/commit/6260c394f4c28d155bbf016a758f3d37a5682a9c.
I've a Spring 3.0.3-based EAR+WAR which I'm deploying to WebLogic 10.3.4.0. I want to be able to see my the various framework Spring Beans at runtime via JMX and ideally in the WebLogic console. (Note, these are NOT bean's we've written but the ones which come by default with Spring.)
Ideally we'd have been able to get it working with the WebLogic Spring Console Extension as described here. However after following all these steps (plus adding the weblogic-spring.jar to our WAR after we saw ClassNotFoundException errors in our WebLogic log when trying to navigate to the Spring tab in the WL Admin UI) we still see the following message in the WL console "This application does not use the Spring Framework or Spring MBean integration is not enabled." and no errors or messages in the log.
Does anyone know if it is possible to get Spring 3 apps working with the WebLogic 10.3.4.0 Spring Console Extension or should I try another route?
Weblogic family 10.3.X supports only Spring Framework 2.5.X