How to add filter after the HTTP BasicAuthenticationFilter when using @EnableAuthorizationServer

Question

I am trying to go over the following documentation: https://github.com/spring-projects/spring-security-oauth/blob/f25592e682303b0cf89e1d7555174bac18e174df/docs/oauth2.md#mapping-user-roles-to-scopes

In the documentation, it says in order to map user roles to scopes, along with setting the checkUserScopes=true in the DefaultOAuth2RequestFactory, we need to add the TokenEndpointAuthenticationFilter filter after the HTTP BasicAuthenticationFilter. I was wondering how that could be done.

Here is what my AuthorizationServer looks like:

@Configuration
@EnableAuthorizationServer
protected static class OAuth2Config extends
        AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private OAuth2RequestFactory requestFactory;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
        endpoints.authenticationManager(authenticationManager);
        endpoints.requestFactory(requestFactory);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients)
            throws Exception {
        clients.withClientDetails(clientDetailsService());
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer)
            throws Exception {
        oauthServer.checkTokenAccess("isAuthenticated()");
    }

    @Bean
    public ClientDetailsService clientDetailsService() {

        Map<String, ClientDetails> clientDetailsStore = new HashMap<String, ClientDetails>();

        Collection<String> scope = new HashSet<String>();
        scope.add("user");
        scope.add("admin");

        Collection<String> authorizedGrantTypes = new HashSet<String>();
        authorizedGrantTypes.add("password");
        authorizedGrantTypes.add("refresh_token");


        BaseClientDetails clientDetails = new BaseClientDetails();
        clientDetails.setClientId("client");
        clientDetails.setClientSecret("secret");
        clientDetails.setScope(scope);
        clientDetails.setAuthorizedGrantTypes(authorizedGrantTypes);

        clientDetailsStore.put("client", clientDetails);

        InMemoryClientDetailsService clientDetailsService = new InMemoryClientDetailsService();
        clientDetailsService.setClientDetailsStore(clientDetailsStore);

        return clientDetailsService;
    }

    @Bean
    public OAuth2RequestFactory requestFactory() {
        DefaultOAuth2RequestFactory requestFactory = 
                new DefaultOAuth2RequestFactory(clientDetailsService());

        requestFactory.setCheckUserScopes(true);

        return requestFactory;
    }
}

Also, it would be fantastic to provide a sample CURL on how we can test the grant-type password.

Appreciate any help!

Dave Syer · Accepted Answer · 2015-04-23 10:50:10Z

7

Instead of using @EnableAuthorizationServer you should be able to extend AuthorizationServerSecurityConfiguration and include that in your Spring configuration. E.g.

@Configuration
public class OAuth2Config extends AuthorizationServerSecurityConfiguration {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
       super.configure(http);
       http.addFilterAfter(myFilter(), BasicAuthenticationFilter.class);
    }
}

answered Apr 23, 2015 at 10:50

Dave Syer

58.3k10 gold badges161 silver badges147 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Ali Moghadam Over a year ago

The Curl to test this is: curl -v -u client:secret "localhost:8083/oauth/token" -d grant_type=password -d username=user -d password=password

GameSalutes Over a year ago

I don't see a "configure" method defined on AuthorizationServerSecurityConfiguration. What version of Spring Oauth is this for?

OrangeDog Over a year ago

@GameSalutes it's present in the latest version (2.3.5.RELEASE).

veritas Over a year ago

I understand that extending AuthorizationServerSecurityConfigutation would inherit configure. Can you tell me how different then is to annotate it instead of extending it?

OrangeDog · Accepted Answer · 2019-06-12 10:37:58Z

0

You can add also add additional filters via the AuthorizationServerSecurityConfigurer, though they come before Basic auth, not after.

@Override
public void configure(AuthorizationServerSecurityConfigurer security) {
    security.addTokenEndpointAuthenticationFilter(myFilter());
    security.checkTokenAccess("isAuthenticated()");
}

Adds a new custom authentication filter for the TokenEndpoint. Filters will be set upstream of the default BasicAuthenticationFilter.

answered Jun 12, 2019 at 10:37

OrangeDog

39.3k18 gold badges141 silver badges227 bronze badges

Collectives™ on Stack Overflow

How to add filter after the HTTP BasicAuthenticationFilter when using @EnableAuthorizationServer

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related