spring-security-oauth2 | 易学教程

EnableOAuth2Sso simultaneously for multiple social networks

阅读更多关于 EnableOAuth2Sso simultaneously for multiple social networks

I am implementing a spring boot application that needs to provide OAuth2 token authorization and support multiple social services (google+, facebook etc). The user should be able to select his preferred social network and sign-in using the OAuth2 authorization framework. I am implementing the above using the approach described here http://cloud.spring.io/spring-cloud-security/ . Currently my application.yml looks like this spring: oauth2: client: clientId: {{my app's google id} clientSecret: {{my app's google secret code}} etc... Also, the spring boot main class is annotated as

Spring security oauth 2 simple example

阅读更多关于 Spring security oauth 2 simple example

问题 I try to implement my own example based on official tutorial Sparklr2/Tonr2. Everything looks good but when I remove from web.xml in my Tonr2 implementation, spring security filter I have exception: No redirect URI has been established for the current request I can't understand what URL should I use. Here is my code, for client implementation:  <oauth:client id="oauth2ClientFilter" />  <oauth:resource id=

How to protect spring-security-oauth resources using @PreAuthorize based on Scope?

阅读更多关于 How to protect spring-security-oauth resources using @PreAuthorize based on Scope?

问题 I successfully configured spring-security-oauth2 so that external apps can authenticate with my application. However based on the external app and based on what the user allows, only a subset of my API should be accessible to clients. The available subset is determined by the OAuth Scopes. In classic Spring applications I could use @PreAuthorize to enforce boundaries based on roles: @Controller public class MyController { @PreAuthorize("hasRole('admin')") @RequestMapping("...") public String

Oauth2 cross origin solution

阅读更多关于 Oauth2 cross origin solution

I'm having an rest application which is written using spring framework and using spring oauth2 for security.. And whenever I'm calling this rest services from my Angular App , I'm getting a CORS error.. both applications are running on my local machine(localhost) but with different port(8080 for backend java and 3000 for frontend).. I've added @crossorigin() in my controller of backend application and all the cross origin for resources APIs are fixed.. but for spring oauth2 authentication url(/oauth/token) this is happening always.. I've tried many ways , but it won't solved my issue. Anyone

Spring Security with OAuth2 and JWT: Encoded password does not look like BCrypt

阅读更多关于 Spring Security with OAuth2 and JWT: Encoded password does not look like BCrypt

问题 I am trying to implement a spring AuthorizationServer with JWT. I was able to produce JWT tokens and login until I added BCrypt to the mix. Now, when I am trying to login, I get "Bad credentials" from the API. OAuth2Configuration.java @Configuration @EnableAuthorizationServer public class OAuth2Configuration extends AuthorizationServerConfigurerAdapter { private DataSource dataSource; private AuthenticationManager authenticationManager; private BCryptPasswordEncoder passwordEncoder; public

Spring OAuth2 disable HTTP Basic Auth for TokenEndpoint

阅读更多关于 Spring OAuth2 disable HTTP Basic Auth for TokenEndpoint

问题 I am starting with Spring OAuth2. So far so good, I have secured my app with the configuration. But I have an issue, my client does not support HTTP Basic Authorization. Is there a way how to disable HTTP Basic Auth for the /oauth/token endpoint? I would like to send the client_id and client_secret in the JSON body or in the request headers. curl examples I would like to work: curl -X POST -H "Content-Type: application/json" -d '{ "username": "user", "password": "pass", "grant_type":

Rest, Spring own OAuth2 server + OAuth2 providers like Facebook, Google, Yahoo

阅读更多关于 Rest, Spring own OAuth2 server + OAuth2 providers like Facebook, Google, Yahoo

问题 In Spring Boot application I have secured my Spring MVC REST endpoints with Spring Security and Spring OAuth2. I have own Authorization\Resource servers so in order to comunicate with our API, client(AngularJS) needs to obtain acessToken from my API Authorization Server. Everything works fine but for authentication/authorization on my API, user needs to create his account and provide us with his username/password. I'd like to simplify this process and would like to propose user to

spring security permitAll still considering token passed in Authorization header and returns 401 if token is invalid

阅读更多关于 spring security permitAll still considering token passed in Authorization header and returns 401 if token is invalid

I am using spring security oauth in my project. I am excluding some urls from authentication by configuring in spring security ResourceServerConfigurerAdapter. I added http.authorizeRequests().antMatchers(url).permitAll() . Now, what I am seeing is that, if I don't pass the Authorization header to these urls, it is not authenticated. And the API is called properly. If the call is made with an Authorization header, then it validates the token and fails the call if the token is not validated. My question is what do I need to do so that the token is ignored in the request for which I have

Spring Security OAuth2: InsufficientAuthenticationException

阅读更多关于 Spring Security OAuth2: InsufficientAuthenticationException

First of all, I disabled basic auth: security.basic.enabled=false Then I access the authorization page: http://localhost:8080/oauth/authorize?client_id=client&response_type=code&redirect_uri=http://www.baidu.com I got following exception: org.springframework.security.authentication.InsufficientAuthenticationException: User must be authenticated with Spring Security before authorization can be completed. at org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(AuthorizationEndpoint.java:138) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na] at sun.reflect

How to get @WebMvcTest work with OAuth?

阅读更多关于 How to get @WebMvcTest work with OAuth?

I just had hard time to get my controllers unit tests working because, IMO, what is in Spring doc is not enough if using OAuth. In my case, it's Oauth2 with JWT. I tried to use @WithMockUser , @WithUserDetails and even define my own annotation with @WithSecurityContext and a custom UserSecurityContextFactory but always got anonymous user in the UserSecurityContext when security expression where evaluated, whatever I set the test context to in my factory... I propose the solution I came to just under, but as I'm not sure mocking the TokenService is the most efficient / clean way to go, please