spring-security-oauth2

Spring Boot Oauth2 Extending DefaultTokenServices

由 拥有回忆 提交于 2019-11-30 17:39:04
问题 I have an OAuth2 implementation that is working fine for the grant type = password. Now I need to add a logic of restricting the same user/password combination to be allowed to login again if the user is logged in earlier. For that, I researched and figured that I to create a new class (MyDefaultTokenService) that extends the DefaultTokenServices class and then add my logic in the overriden createAccessToken method. But for some reason when I debug and test, I dont hit the breakpoints placed

Why is AccessTokenRequest's PreservedState perpetually null with a resultant CSRF related InvalidRequestException?

由 ╄→尐↘猪︶ㄣ 提交于 2019-11-30 15:39:37
As context, I've been trying to get a fairly simple @SprintBootApplication with an additional @EnableOAuth2Sso annotation integrated with WSO2 Identity Server for quite some time now. In my mind getting this working should be a matter of configuration (as advertised on Spring Cloud Security ) - but I've had no luck thus far. In an effort to understand what is going on I've used my debugger to step through spring-security-oauth2 code to figure out what is going on. In doing so I've noticed that my AccessTokenRequest's PreservedState is perpetually null with a resultant CSRF related

Spring OAuth 2 + JWT Inlcuding additional info JUST in access token

由 旧街凉风 提交于 2019-11-30 15:38:42
I am able to include additional information into the access token implementing my own TokenEnhancer, but such info is included twice. One in the encoded access_token, and the other in the auth server response. Long story short! I request an access token with right credentials, and I get this response: { "access_token" : "eyJhbGciOiJSUzI1NiJ9.eyJjbGllbnRJZCI6Ik1ZX0NVU1RPTV9JTkZPX0NMSUVOVCIsInVzZXJfbmFtZSI6IlVTRVIiLCJzY29wZSI6WyJGT08iXSwiZXhwIjoxNTA2MzkwOTM5LCJhdXRob3JpdGllcyI6WyJST0xFX1VTRVIiXSwianRpIjoiZjJkYWFkM2ItYzkzOC00ZjExLWI3ODctMzExZDdlNjYzYzhhIiwiY2xpZW50X2lkIjoid2ViX2FwcCJ9

Skip OAuth user approval in Spring Boot OAuth2

由 帅比萌擦擦* 提交于 2019-11-30 14:48:44
问题 I just want to know if there is any way to skip User approval screen in Spring Boot - Spring Security OAuth2. I heard about custom user approval handler but I am quite not sure how to override it to disable user approval process and do a direct redirect. Thanks 回答1: You don't need a custom handler to skip approval (since 2.0 anyway). You just set the autoApprove flag in the client details to "true" (or a list of scope patterns to auto approve). 回答2: This is how I changed it in my JHipster

Spring OAuth: Resource Server with Authorization Server backend

由 本小妞迷上赌 提交于 2019-11-30 13:21:43
问题 I want to develop two independent services, one for the business stuff and one for the user authentication using Spring OAuth 2 Let's call them Business-Service and OAuth-Service. Now I want the Business-Service delegate to the OAuth-Service if a request is not authenticated. The client application (an Android app) should not know about the OAuth-Service a priori, it should only be delegated to it by the Business-Service with an 302 HTTP redirect for non-authenticated request. To be precise,

OAuth2ClientContext (spring-security-oauth2) not persisted in Redis when using spring-session and spring-cloud-security

由 别来无恙 提交于 2019-11-30 13:21:35
问题 Thanks a lot in advance for reading this question. Setup I am using: spring-security-oauth2:2.0.7.RELEASE spring-cloud-security:1.0.1.RELEASE spring-session:1.0.1.RELEASE and would have a question regarding the persistence of spring-security-oauth2 OAuth2ClientContext in a Redis datastore when using spring-session (via @EnableRedisHttpSession ) in a Single-Sign-On ( @EnableOAuth2Sso ), reverse proxy ( @EnableZuulProxy ) gateway. Problem It seems to me that the SessionScoped

Request new access token using refresh token in username-password grant in Spring Security OAuth2

由 橙三吉。 提交于 2019-11-30 13:10:14
问题 We're using the username-password grant to obtain an access token from our auth server. We want to refresh the access token before it expires using the provided refresh token until the user logs out or closes the client app. However I just cannot find any examples of how to issue this refresh token request.. To obtain the token we call something like: curl -v --data "grant_type=password&username=user&password=pass&client_id=my_client" http://localhost:8080/oauth/token So to refresh I'd expect

Skip OAuth user approval in Spring Boot OAuth2

由 坚强是说给别人听的谎言 提交于 2019-11-30 12:19:51
I just want to know if there is any way to skip User approval screen in Spring Boot - Spring Security OAuth2. I heard about custom user approval handler but I am quite not sure how to override it to disable user approval process and do a direct redirect. Thanks You don't need a custom handler to skip approval (since 2.0 anyway). You just set the autoApprove flag in the client details to "true" (or a list of scope patterns to auto approve). Pedro Madrid This is how I changed it in my JHipster application: @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

Spring security oauth 2 simple example

由 别等时光非礼了梦想. 提交于 2019-11-30 09:32:40
I try to implement my own example based on official tutorial Sparklr2/Tonr2 . Everything looks good but when I remove from web.xml in my Tonr2 implementation, spring security filter I have exception: No redirect URI has been established for the current request I can't understand what URL should I use. Here is my code, for client implementation: <!--apply the oauth client context --> <oauth:client id="oauth2ClientFilter" /> <!--define an oauth 2 resource for sparklr --> <oauth:resource id="provider" type="authorization_code" client-id="client" client-secret="secret" access-token-uri="http:/

Spring Security with OAuth2 and JWT: Encoded password does not look like BCrypt

由 只谈情不闲聊 提交于 2019-11-30 08:35:49
I am trying to implement a spring AuthorizationServer with JWT. I was able to produce JWT tokens and login until I added BCrypt to the mix. Now, when I am trying to login, I get "Bad credentials" from the API. OAuth2Configuration.java @Configuration @EnableAuthorizationServer public class OAuth2Configuration extends AuthorizationServerConfigurerAdapter { private DataSource dataSource; private AuthenticationManager authenticationManager; private BCryptPasswordEncoder passwordEncoder; public OAuth2Configuration(AuthenticationManager authenticationManager) { this.authenticationManager =
订阅 spring-security-oauth2