Securing spring websockets using remote SSO server

Question

I am using microservices architecture so I have a separate SSO service which handles all the authentication and authorization requests.

I am using spring websockets in other service and I need to secure it using tokens handled by SSO, so I added this configuration for securing websockets.

@Configuration
@EnableResourceServer
public class WebSocketSecurityConfig extends AbstractSecurityWebSocketMessageBrokerConfigurer {

@Override
protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
    messages
            .nullDestMatcher().authenticated()
            .simpTypeMatchers(CONNECT).authenticated()
            .simpDestMatchers("/ws/**").hasRole("USER")
            .simpSubscribeDestMatchers("/ws/**").hasRole("USER")
            .anyMessage().denyAll();
}

@Override
protected boolean sameOriginDisabled() {
    return true;
}

}

And for websocket config

@Configuration
@EnableWebSocketMessageBroker
public class WebSocketConfig extends AbstractWebSocketMessageBrokerConfigurer {

@Override
public void configureMessageBroker(MessageBrokerRegistry config) {
    config.enableSimpleBroker("/ws/topic");
    config.setApplicationDestinationPrefixes("/ws/view");
}

@Override
public void registerStompEndpoints(StompEndpointRegistry registry) {
    registry.addEndpoint("/socket/").withSockJS();
}
}

And for remote SSO server

@Override
public void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests().antMatchers(HttpMethod.OPTIONS, "/api/**").permitAll()
            .antMatchers("/api/**").access("#oauth2.hasScope('service-name')");
    http.csrf().disable();
    http.httpBasic().disable();
}

@Bean
@Primary
@RefreshScope
public CachedRemoteTokenService tokenServices() {
    final CachedRemoteTokenService remoteTokenServices = new CachedRemoteTokenService();
    remoteTokenServices.setCheckTokenEndpointUrl(getCheckTokenEndPointUrl());
    remoteTokenServices.setClientId(getClientId());
    remoteTokenServices.setClientSecret(getClientSecret());
    return remoteTokenServices;
}

I added the token in the client but it throws AccessDeniedException

var headers = {
    Authorization: 'Bearer ' + myToken
}
stompClient.send("/ws/view/update/", headers, JSON.stringify(view));

I checked the SSO server logs and I found it didn't call it at all! Is there something missing?

Any help will be appreciated

Securing spring websockets using remote SSO server

0 Answers0