How can I use curl to obtain access token for a Spring Boot Rest API?

Question

I am developing a Spring Boot Rest API using token authentication.However I don't know how to obtain access token using curl.I have developed a client for this application but I can't obtain access token using the Spring client.

Here is the AuthorizationServerConfig.java file:

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
    @Autowired
    private TokenStore tokenStore;

    @Autowired
    private JwtAccessTokenConverter accessTokenConverter;


   @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    public void configure(ClientDetailsServiceConfigurer configurer) throws Exception{
        configurer
                .inMemory()
                .withClient(clientId)
                .secret(passwordEncoder.encode(clientSecret))
                .authorizedGrantTypes(grantType)
                .scopes(scopeRead,scopeWrite)
                .accessTokenValiditySeconds(1*60*60)
                .refreshTokenValiditySeconds(6*60*60)
                .resourceIds(resourceIds);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception{
        TokenEnhancerChain enhancerChain=new TokenEnhancerChain();
        enhancerChain.setTokenEnhancers(Arrays.asList(accessTokenConverter));
        endpoints.tokenStore(tokenStore)
                .accessTokenConverter(accessTokenConverter)
                .tokenEnhancer(enhancerChain)
                .authenticationManager(authenticationManager);
    }
}

Here is the ResourceServerConfig.java file:

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    @Autowired
    private ResourceServerTokenServices tokenServices;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception{
        resources.resourceId(resourceIds).tokenServices(tokenServices);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception{
        http
                .requestMatchers()
                .and()
                .authorizeRequests()
                .antMatchers("/actuator/**","/api-docs/**").permitAll()
                .antMatchers("/data-service/**").authenticated();
    }

}

Here is the WebSecurityConfig.java file:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public BCryptPasswordEncoder passwordEncoder(){
        BCryptPasswordEncoder bCryptPasswordEncoder=new BCryptPasswordEncoder(11);
        return bCryptPasswordEncoder;
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception{
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception{
        }

    @Override
    protected void configure(HttpSecurity http) throws Exception{

            http
                    .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and()
                    .httpBasic()
                    .realmName(securityRealm)
                    .and()
                    .csrf()
                    .disable();

    }

    @Bean
    public JwtAccessTokenConverter accessTokenConverter(){
        JwtAccessTokenConverter converter=new JwtAccessTokenConverter();
        converter.setSigningKey(signingKey);
        return converter;
    }

    @Bean
    public TokenStore tokenStore(){
        return new JwtTokenStore(accessTokenConverter());
    }

    @Bean
    @Primary
    public DefaultTokenServices tokenServices(){
        DefaultTokenServices defaultTokenServices=new DefaultTokenServices();
        defaultTokenServices.setTokenStore(tokenStore());
        defaultTokenServices.setSupportRefreshToken(true);
        return defaultTokenServices;
    }
}

How can I obtain access token using curl?

Answer 1

There are different grant types to obtain tokens. I'd suggest reading https://www.rfc-editor.org/rfc/rfc6749 to get a better understanding.

Following curl command is to get a token using the client credentials grant type. You need to pass the Basic Authorization header. The format of it Basic base64(Client_name:Client_secret)

curl -X POST http://localhost:8080/oauth/token -H 'authorization: Basic b2F1dGgyLWp3dC1jbGllbnQ6YWRtaW4xMjM0' -H 'content-type: multipart/form-data -F grant_type=client_credentials