Hi I am using spring boot for my project so I am not using xml for any of my configurations, only java. I am using this project on github as a reference https://github.com/techdev-solutions/jaxenter-showcase .
When I make a request(http://localhost:8081/oauth/authorize?client_id=web&response_type=token with username and password in header) for the token it returns the redirect html site not the token.. How do I configure oauth2 to return the token in the response.
If I send a request using curl it gives me exactly what I want: curl curl:password@localhost:8081/oauth/token\?grant_type=client_credentials
if I try to mimic the same request via a http client http://localhost:8081/oauth/token?client_secret=password&client_id=curl&grant_type=client_credentials
I get 401 unauthorized
Here is my java config:
package de.techdev.jaxenter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JdbcTokenStore;
import javax.sql.DataSource;
/**
* @author Moritz Schulze
*/
@Configuration
@EnableAuthorizationServer
public class OAuthConfiguration extends AuthorizationServerConfigurerAdapter {
@Autowired
private DataSource dataSource;
@Bean
public TokenStore tokenStore() {
return new JdbcTokenStore(dataSource);
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.tokenStore(tokenStore());
}
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory()
.withClient("curl") //curl curl:password@localhost:8081/oauth/token\?grant_type=client_credentials
.authorities("ROLE_ADMIN")
.resourceIds("jaxenter")
.scopes("read", "write")
.authorizedGrantTypes("client_credentials")
.secret("password")
.and()
.withClient("web") //http://localhost:8081/oauth/authorize?client_id=web&response_type=token
.redirectUris("http://github.com/techdev-solutions/")
.authorities("ROLE_ADMIN")
.resourceIds("jaxenter")
.scopes("read, write")
//.authorizedGrantTypes("implicit")
.authorizedGrantTypes("implicit","client_credentials")
.autoApprove(true)
.secret("password")
.and()
.withClient("my-trusted-client")
.authorizedGrantTypes("password","authorization_code","refresh_token","implicit","redirect")
.authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
.scopes("read", "write", "trust")
.redirectUris("http://localhost:8080")
.authorizedGrantTypes("implicit")
.accessTokenValiditySeconds(60)
.refreshTokenValiditySeconds(30);
}
}
package de.techdev.jaxenter;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
/**
* @author Moritz Schulze
*/
@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.withUser("John").roles("ADMIN").password("password")
.and()
.withUser("Mary").roles("BASIC").password("password");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().antMatchers("/**").authenticated()
.and().httpBasic().realmName("OAuth Server");
}
}
also discovered a post with similar issue that is unresolved Spring Security OAUTH2 getting token with username/password
