0

I was following a few examples for securing REST api with spring security (via configuration not XML). I have the following classes:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserManager userManager;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userManager);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().antMatchers("/**").authenticated().and().httpBasic().realmName("OAuth Server");
    }
}

@Configuration
@EnableAuthorizationServer
public class OAuthConfiguration extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore());
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.jdbc(dataSource);
    }
}

and of course my UserManager extends UserDetailsService

when I try to make a call to retrieve a user for a signed up user,

GET http://localhost:8080/oauth/token?grant_type=password&username=be@gmail.com&password=123

I get: 404 - page not found.

What is wrong?

EDITED: my web.xml. 

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">

    <filter>
        <filter-name>CorsFilter</filter-name>
        <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
        <init-param>
            <param-name>cors.allowed.origins</param-name>
            <param-value>*</param-value>
        </init-param>
        <init-param>
            <param-name>cors.allowed.methods</param-name>
            <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
        </init-param>
        <init-param>
            <param-name>cors.allowed.headers</param-name>
            <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
        </init-param>
        <init-param>
            <param-name>cors.exposed.headers</param-name>
            <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
        </init-param>
        <init-param>
            <param-name>cors.support.credentials</param-name>
            <param-value>true</param-value>
        </init-param>
        <init-param>
            <param-name>cors.preflight.maxage</param-name>
            <param-value>10</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>CorsFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

   <!-- do not change the order. Static should be served before any other -->
    <context-param>
        <param-name>contextClass</param-name>
        <param-value>
            org.springframework.web.context.support.AnnotationConfigWebApplicationContext
        </param-value>
    </context-param>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>com.estartup.config.PersistenceConfig</param-value>
    </context-param>

    <!-- Bootstrap the root application context as usual using ContextLoaderListener -->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <servlet>
        <servlet-name>jersey-servlet</servlet-name>
        <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
        <init-param>
            <param-name>javax.ws.rs.Application</param-name>
            <param-value>com.estartup.config.AlgopixApplication</param-value>
        </init-param>

        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>jersey-servlet</servlet-name>
        <url-pattern>/api/*</url-pattern>
    </servlet-mapping>
</web-app>
Dejell
  • 13,947
  • 40
  • 146
  • 229
  • Also share your `web.xml` and spring security/oauth config xml. I suspect something might be wrong there. – Pramod Karandikar Feb 24 '15 at 12:24
  • I added web.xml. I don't have spring-securty/oath config xml - I defined it in the @configuration classes – Dejell Feb 24 '15 at 12:26
  • Had faced a similar issue earlier, I recall this was missing in my setup in `web.xml`. You could try adding it. ` spring org.springframework.web.servlet.DispatcherServlet 1 ` Also, not sure why app name is missing in the URL. – Pramod Karandikar Feb 24 '15 at 12:30
  • app-name is missing as in server.xml the docbase is /. I will try the servlet addition. Not sure why I need it if I use @configuration – Dejell Feb 24 '15 at 12:33
  • I added the servlet but it doesn't help – Dejell Feb 24 '15 at 12:40

2 Answers2

0

did you try to use REST-client to invoke the call?

plus, i think the app-name is missing in the URL - is should be something like GET 

http://localhost:8080/<app-name>/oauth/token?grant_type=password&username=be@gmail.com&password=123
OhadR
  • 8,276
  • 3
  • 47
  • 53
  • yes. I am using client. No need to define the app-name as in server.xml the docbase is / – Dejell Feb 24 '15 at 12:31
  • so the auth-server is "/", and what about the resource server and the client app? – OhadR Feb 24 '15 at 14:12
  • I didn't get the last comment. client app -it's a rest api. – Dejell Feb 24 '15 at 14:19
  • i meant the oauth-client and oauth-resource-server – OhadR Feb 24 '15 at 21:07
  • can you pls elaborate? I just have a Jersey rest-api – Dejell Feb 24 '15 at 21:15
  • oauth mechanism is built from the auth-server, resource-server and client. read about it a bit, it will help u design your module... for example http://stackoverflow.com/questions/14522634/spring-security-oauth-2-simple-example/14525396#14525396 – OhadR Feb 25 '15 at 06:38
  • thanks. I wrote a comment there. I don't need redirect URI for now – Dejell Feb 25 '15 at 09:15
0

I had to add:

<servlet>
        <servlet-name>spring</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>2</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>spring</servlet-name>
        <url-pattern>/oauth/token</url-pattern>
    </servlet-mapping>

with mapping the servlet. why can't it be done via the @configuration?

Dejell
  • 13,947
  • 40
  • 146
  • 229