15

I successfully configured spring-security-oauth2 so that external apps can authenticate with my application. However based on the external app and based on what the user allows, only a subset of my API should be accessible to clients. The available subset is determined by the OAuth Scopes.

In classic Spring applications I could use @PreAuthorize to enforce boundaries based on roles:

@Controller
public class MyController {
  @PreAuthorize("hasRole('admin')")
  @RequestMapping("...")
  public String doStuff() {
    // ...
  }
}

How do I do the same when using OAuth and with Scopes instead of roles?

yankee
  • 38,872
  • 15
  • 103
  • 162

1 Answers1

29

Spring OAuth ships with the OAuth2MethodSecurityExpressionHandler, a class that adds the ability to do such checks using the @PreAuthorize expressions. All you need to do is register this class, e.g. like this if you are using Javaconfig:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public static class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        return new OAuth2MethodSecurityExpressionHandler();
    }
}

Now you can simply use:

@PreAuthorize("#oauth2.hasScope('requiredScope')")

to secure your request methods. To see which further methods are available besided hasScope check the class OAuth2SecurityExpressionMethods.

The downside is that OAuth2MethodSecurityExpressionHandler extends the DefaultMethodSecurityExpressionHandler and thus you cannot combine it with other classes that also extend this class.

As an alternative you could also map OAuth scopes to classic user roles.

Community
  • 1
  • 1
yankee
  • 38,872
  • 15
  • 103
  • 162
  • 2
    I am using Spring Boot 1.5.10 and the `#oauth2.hasScope...` works without overriding `createExpressionHandler()` – Wim Deblauwe Feb 26 '18 at 09:29
  • 1
    Do you have any idea how I can unit test a function using @PreAuthorize("#oauth2.hasScope('requiredScope')")? I have sorted it out for other security criteria but I can't figure out this one. – Rig Feb 27 '18 at 21:50