3

First of all, I disabled basic auth:

security.basic.enabled=false

Then I access the authorization page:

http://localhost:8080/oauth/authorize?client_id=client&response_type=code&redirect_uri=http://www.baidu.com

I got following exception:

org.springframework.security.authentication.InsufficientAuthenticationException: User must be authenticated with Spring Security before authorization can be completed.
    at org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(AuthorizationEndpoint.java:138) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_45]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_45]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_45]
    at java.lang.reflect.Method.invoke(Method.java:497) ~[na:1.8.0_45]
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:221) ~[spring-web-4.2.7.RELEASE.jar:4.2.7.RELEASE]
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136) ~[spring-web-4.2.7.RELEASE.jar:4.2.7.RELEASE]
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:110) ~[spring-webmvc-4.2.7.RELEASE.jar:4.2.7.RELEASE]
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:832) ~[spring-webmvc-4.2.7.RELEASE.jar:4.2.7.RELEASE]
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:743) ~[spring-webmvc-4.2.7.RELEASE.jar:4.2.7.RELEASE]
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85) ~[spring-webmvc-4.2.7.RELEASE.jar:4.2.7.RELEASE]
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:961) ~[spring-webmvc-4.2.7.RELEASE.jar:4.2.7.RELEASE]
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:895) ~[spring-webmvc-4.2.7.RELEASE.jar:4.2.7.RELEASE]
    at ...

I don't understand why I have to do authentication first before OAuth?

Neo
  • 2,196
  • 5
  • 32
  • 58

1 Answers1

7

The flow for the authorization code grant goes like this:

  1. Client redirects the user to auth server's authorization page. Hence the http://localhost:8080/oauth/authorize?client_id=client&response_type=code&redirect_uri=http://www.baidu.com
  2. If the user were already logged in, the user would be immediately shown an authorization page where he can approve the authorization request. If the user is not yet logged in, he should be redirected to a login page first to authenticate himself to let Spring Security know who is giving the authorization.

What you probably need to do is secure the authorization endpoint by requiring a role granted like this in xml:

<security:http disable-url-rewriting="true"
               use-expressions="true"
               entry-point-ref="loginEntryPoint">
    ...

    <security:intercept-url pattern="/oauth/authorize" access="hasRole('ROLE_USER')"/>
    ...
</security:http>

If the user is not yet logged in, this will trigger Spring Security to redirect the user to login as configured in your loginEntryPoint. Typically, you would redirect the user to a login page. After successfully authenticating, the user will return to the authorization endpoint.

sofiaguyang
  • 1,123
  • 1
  • 14
  • 21
  • What if the server is stateless ? It has no session. My authorization server could have a login controller or filter, but how would it notify Spring Security that the user credentials are correct ? – Stephane Nov 01 '18 at 13:45
  • @Stephane your authorization server needs to have session enabled. You can scale your application by relying on something like redis to do the session management. – sofiaguyang Nov 06 '18 at 00:15
  • 4
    I configured my authorization server to authenticate using a JWT access token, with a login filter creating the token, and passing the token in a header when sending a request to the `/oauth/authorize` endpoint. This way I skip using the session and my authorization server is stateless. – Stephane Nov 06 '18 at 13:02