1

I have tried to develop Oauth and got the example from Oauth DZone. It is in maven. I have gradle build containing of following dependencies. I am using spring boot 1.5.9

 compile('org.springframework.boot:spring-boot-starter')
 testCompile('org.springframework.boot:spring-boot-starter-test')
 compile('org.springframework.security.oauth:spring-security-oauth2:2.0.14.RELEASE')
 compile('org.springframework.boot:spring-boot-starter-web')
 testCompile('org.springframework.boot:spring-boot-starter-test')
 compile('org.springframework.boot:spring-boot-starter-data-jpa')

 runtime('mysql:mysql-connector-java:5.1.44')

 compile group: 'org.springframework.hateoas', name: 'spring-hateoas', version: '0.16.0.RELEASE'
 compile('org.springframework.boot:spring-boot-starter-security')
compile group: 'org.springframework.security',name:'spring-security-jwt', version:'1.0.8.RELEASE'

compile group: 'org.springframework', name: 'spring-context-support'
compile('org.springframework.boot:spring-boot-starter-tomcat')  
providedRuntime("org.springframework.boot:spring-boot-starter-tomcat")

compile group: 'org.springframework.boot', name: 'spring-boot-starter-mail', version: '1.2.0.RELEASE'
compile group: 'org.springframework.boot', name: 'spring-boot-starter-aop', version: '1.5.9.RELEASE'

But the same code doesn't work and give me error 403 forbidden

I also found a link asking not to use gradle but use maven No gradle only maven

My Gradle code worked for getting the users (userinfo) and also getting oauth token is also working. When I have written extra controllers and services it is not working. So I removed all code and put the code which worked with Maven and with gradle as done in starting but it failed.

Used the following

@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
   private static final String RESOURCE_ID = "resource-server-rest-api";
   private static final String SECURED_READ_SCOPE = "#oauth2.hasScope('read')";
   private static final String SECURED_WRITE_SCOPE = "#oauth2.hasScope('write')";
   private static final String SECURED_PATTERN = "/secured/**";
   @Override
   public void configure(ResourceServerSecurityConfigurer resources) {
       resources.resourceId(RESOURCE_ID);
   }
   @Override
   public void configure(HttpSecurity http) throws Exception {
    /*http.requestMatchers()
            .antMatchers(SECURED_PATTERN).and().authorizeRequests()
            .antMatchers(HttpMethod.POST, SECURED_PATTERN).access(SECURED_WRITE_SCOPE)
            .anyRequest().access(SECURED_READ_SCOPE);*/
       http.antMatcher("/**")
       .authorizeRequests().anyRequest().authenticated();
   }
 }


  package org.com.example.configuration;

 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
 import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
 import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
 import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
 import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
 import org.springframework.security.oauth2.provider.token.TokenStore;
 import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
 import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;

 @Configuration
 @EnableAuthorizationServer
 public class OAuthConfiguration extends AuthorizationServerConfigurerAdapter {

  @Autowired
  @Qualifier("authenticationManagerBean")
  private AuthenticationManager authenticationManager;

  @Autowired
  UserDetailsService userDetailsService;

  @Override
  public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
    oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
  }

  @Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.inMemory()
    .withClient("fooClientId").secret("secret")
    .authorizedGrantTypes("password", "authorization_code", "refresh_token").scopes("read","write")
    .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT", "USER","ADMIN")
    .autoApprove(true)
    .accessTokenValiditySeconds(180)//Access token is only valid for 3 minutes.
    .refreshTokenValiditySeconds(600);//Refresh token is only valid for 10 minutes.;
}

  @Override
  public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    endpoints.tokenStore(tokenStore()).authenticationManager(authenticationManager).accessTokenConverter(defaultAccessTokenConverter())
    .userDetailsService(userDetailsService);
}

@Bean
public TokenStore tokenStore(){
    return new JwtTokenStore(defaultAccessTokenConverter());    
}

@Bean
public JwtAccessTokenConverter defaultAccessTokenConverter() {
    JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
    converter.setSigningKey("123");
    return converter;
 }
}

I request for suggestions and also let me know if gradle doesn't work with oauth2 (spring boot 1.5.9)

kishore
  • 33
  • 7
  • Maven and Gradle are just build systems, if you configure them correctly, they will give you the exact same dependencies and things should work. If you are just starting with Spring Boot, make sure to use Spring Boot 2.x as the 1.x is no longer supported. – Wim Deblauwe Feb 20 '20 at 07:40
  • @Wim our company uses older version of tomcat i.e., 7. So we are using this release. – kishore Feb 20 '20 at 08:27
  • Apart from not supported you are using a very old version most recent 1.X is https://search.maven.org/artifact/org.springframework.boot/spring-boot-maven-plugin/1.5.22.RELEASE/maven-plugin – khmarbaise Feb 20 '20 at 09:27
  • Thanks but oauth2 is introduced even in old version so i think there should be some support for that. i know that the latest version 2.2.1 but for that tomcat should be upgraded but we are using tomcat 7 servlet container – kishore Mar 06 '20 at 05:53

0 Answers0