baeldung / spring-security-oauth Goto Github PK
View Code? Open in Web Editor NEWJust Announced - "Learn Spring Security OAuth":
Home Page: http://bit.ly/github-lsso
License: MIT License
Just Announced - "Learn Spring Security OAuth":
Home Page: http://bit.ly/github-lsso
License: MIT License
Can you please elaborate how storing the token in a cookie prevents from CSRF attacks? To be honest this should be a comment on the article but adding comments is not enabled
I tried running the authorization server and I get the following:
Field passwordEncoder in org.baeldung.config.WebSecurityConfig required a bean of type 'org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder' that could not be found.
In the thymeleaf client,
In the SecurityConfig,
http.authorizeRequests()
.antMatchers("/").permitAll()
.anyRequest().authenticated()
.and()
.oauth2Login()
.and()
.logout().logoutSuccessUrl("/");
When user logout, not a real logout is done, because when we click to login, last user is connected directly.
Surely a call must be done to delete token?
what about client cookie?
Hi guys, i really need your help, without a solution to this problem, i can't make a progress in my project that is too similar to this one, i followed the full Baeldung tutorial, i downloaded the full project, i did what it must be done to make the 4 apps running simultaneously.
I ran the 4 sub-modules on different ports. (8081, 8082, 8083, 8084)
The problem that i'm facing is that both implicit and password clients can't consume the rest API, even after obtaining the access token.
Below, a list of figures that explains my problem.
This is the implicit client.
Trying to access the 2 Resources (Foo, Bar Rest Web service)
This figure, show the redirection to the authorization server.
What happens now, is that i represent my credentials to receive the access token
After a successful authentication, the authorization server asks the resource owner for approval.
Now after obtaining the access token, i was redirected to the implicit client with an access token this time. I'll try to access the resource.
This is the problem, check the 401 Unauthorized Http response
It's like this entire token process was useless.
These are the scripts that insure the extraction and the sending process
Scripts.zip
Guys, if you have anything that can help me to solve this problem, please, share it.
If you need any piece of code, i'll post it.
Dear eugenp,
I am trying to figure out how I can test this implementation, I see you did a lot of work in order to get a clean demo of oauth2 implementation in Spring, however, I wasn't able to validate that it does work.
I have cloned the project and executed within directory the command
mvn clean install
As recommended, I have installed eclipse and opened the project in eclipse.
In order to start all of them at once, I had to configure ports and database.
I have replaced the content of the following files:
/spring-security-oauth-resource/src/main/resources/application.properties
server.contextPath=/spring-security-oauth-resource
server.port=8082
/spring-security-oauth-resource/src/main/resources/persistence.properties
jdbc.driverClassName=com.mysql.jdbc.Driver
jdbc.url=jdbc:mysql://localhost:3306/oauth2?createDatabaseIfNotExist=true
jdbc.user=ajt
jdbc.pass=***
/spring-security-oauth-server/src/main/resources/application.properties
server.contextPath=/spring-security-oauth-server
server.port=8083
/spring-security-oauth-server/src/main/resources/persistence.properties
################### DataSource Configuration ##########################
jdbc.driverClassName=com.mysql.jdbc.Driver
jdbc.url=jdbc:mysql://localhost:3306/oauth2?createDatabaseIfNotExist=true
jdbc.user=ajt
jdbc.pass=***
/spring-security-oauth-ui-implicit/src/main/resources/application.properties
I have started the 4 applications :
I did the following test :
I pressed the login button after filling input login with john
and input password 123
and got redirected to the same login view.
I have no clue how to test the UI implicit.
Here are my questions:
I'd like to add custom claims to the JWT token created in OAuth2AuthorizationServerConfigJwt. How can I do this?
Hi I tried to run the server but its impossible now, I used to have an old version of this and it used to work but now I`m getting this:
Loaded JDBC driver: com.mysql.jdbc.Driver
2017-05-09 19:37:50.918 WARN 3953 --- [ restartedMain] ationConfigEmbeddedWebApplicationContext : Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'revokeTokenEndpoint': Injection of resource dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'tokenServices' defined in class path resource [org/baeldung/config/OAuth2AuthorizationServerConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.DefaultTokenServices]: Factory method 'tokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'tokenStore' defined in class path resource [org/baeldung/config/OAuth2AuthorizationServerConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'tokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'dataSource' defined in class path resource [org/baeldung/config/OAuth2AuthorizationServerConfig.class]: Initialization of bean failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'dataSourceInitializer': Invocation of init method failed; nested exception is org.springframework.jdbc.datasource.init.UncategorizedScriptException: Failed to execute database script; nested exception is org.springframework.jdbc.CannotGetJdbcConnectionException: Could not get JDBC Connection; nested exception is java.sql.SQLException: Access denied for user 'tutorialuser'@'localhost' (using password: YES)
2017-05-09 19:37:50.924 WARN 3953 --- [ restartedMain] o.s.boot.SpringApplication : Error handling failed (Error creating bean with name 'delegatingApplicationListener' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Initialization of bean failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.transaction.annotation.ProxyTransactionManagementConfiguration': Initialization of bean failed; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'org.springframework.context.annotation.ConfigurationClassPostProcessor.importRegistry' available)
2017-05-09 19:37:50.935 ERROR 3953 --- [ restartedMain] o.s.boot.SpringApplication : Application startup failed
Thanks for your time, I`m trying to find out the way to get a valid token from javascript as its not working in my custom rest mongo api with oauth2 and spring.
I am getting this issue on the resource server when i user zuul filter other wise it works , any help
Could you please give us the detailed steps to run this application?
I have started the 4 applications in separate ports, but after that i don't know how to proceed further.
Replacing the JwtTokenStore with a JdbcTokenStore type causes the oauth-ui-password application to 400 on "Refresh Access Token" after the first attempt
`
@bean
@primary
public DefaultTokenServices tokenServices() {
final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
defaultTokenServices.setTokenStore(tokenStore());
defaultTokenServices.setSupportRefreshToken(true);
return defaultTokenServices;
}
@Override
public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
final TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer(), accessTokenConverter()));
endpoints.tokenStore(tokenStore()).tokenEnhancer(tokenEnhancerChain).authenticationManager(authenticationManager);
}
// @Bean
// public TokenStore tokenStore() {
// return new JwtTokenStore(accessTokenConverter());
// }
@Bean
public TokenStore tokenStore() {
return new JdbcTokenStore(datasource);
}`
http://localhost:8084/oauth/token 400s after the 2nd call to "Refresh Access Token". Is the refresh token getting replaced accidently after "Refresh Access Token" is hit?
Regarding this article https://www.baeldung.com/spring-security-oauth-jwt
In section 5. Custom Claims in the Token.
I'd like to point out that overriding enhance
method from TokenEnhancer
won't add custom claims to token payload. It will only add extra fields in the final json token response.
My question is what do I have to do to add custom claims to JWT token payloads?
I've pulled the project and use jdbcTokenStore configuration; when I try to login on http://localhost:8084/ I enter john:123 a recurring login popup keep showing and i'm stuck in the login page.
In the angularJS password project 'im getting in conseole :
: pre filter
2018-12-10 01:45:49.456 INFO 57492 --- [nio-8084-exec-3] c.t.e.config.CustomPreZuulFilter : null
2018-12-10 01:45:49.474 INFO 57492 --- [nio-8084-exec-3] c.t.e.config.CustomPostZuulFilter : in zuul filter /oauth/token
2018-12-10 01:46:05.955 INFO 57492 --- [nio-8084-exec-4] c.t.e.config.CustomPreZuulFilter : in zuul filter /oauth/token
2018-12-10 01:46:05.955 INFO 57492 --- [nio-8084-exec-4] c.t.e.config.CustomPreZuulFilter : pre filter
2018-12-10 01:46:05.955 INFO 57492 --- [nio-8084-exec-4] c.t.e.config.CustomPreZuulFilter : Basic am9objoxMjM=
2018-12-10 01:46:05.975 INFO 57492 --- [nio-8084-exec-4] c.t.e.config.CustomPostZuulFilter : in zuul filter /oauth/token
Thank's
I have pulled the project and without making any change, started the 3 following services:
john:123
and land on /index
tom:111
, I open the developer tools using F12, go under resources tab, and remove all cookies for localhost, this will remove your access_token.isthissecure:letssee
and press the login button, I now land on the /index
, the same cookie as for john is present, and the username on the uper right corner is john.How can I remove this cookie ? I have tried to add a logout button and map it to $scope.doLogout
, then call it on press
cookie.remove("access_token")
window.location = '/login'
But this doesn't repair anything.
tom:111
will also log me in as john.I have changed the port number and ran the application, getting the either missing grant_type or bad credentails, I really appreciate your input to fix this issue.
In module "oauth-authorization-server" there is 3 configs (branch master):
./src/assets
folder (required to build).Suggested fix: Create the ./src/assets
folder and add an empty .gitkeep
file in the folder to ensure the build can still see the directory exists (e.g. ./src/assets/.gitkeep
)
RxJs
runtime error created by OAuthService
. Steps to reproduce: clone, cd ./clients-angular4/oauth-ui-implicit-angular4/src/main/resources
, npm i
, npm start
, open browser to http://localhost:8086/, see console errors.Suggested fix: delete package-lock.json
from source control.
Error details:
```
ERROR Error: Uncaught (in promise): TypeError: rxjs_1.Observable.create(...).publish is not a function
TypeError: rxjs_1.Observable.create(...).publish is not a function
at new OAuthService (oauth-service.js:29)
at _createClass (core.js:9262)
at _createProviderInstance$1 (core.js:9234)
at resolveNgModuleDep (core.js:9200)
at NgModuleRef_.push../node_modules/@angular/core/fesm5/core.js.NgModuleRef_.get (core.js:9911)
at resolveDep (core.js:10276)
at createClass (core.js:10152)
at _createProviderInstance (core.js:10133)
at createProviderInstance (core.js:10016)
at createViewNodes (core.js:11242)
at createRootView (core.js:11169)
at callWithDebugContext (core.js:12204)
at Object.debugCreateRootView [as createRootView] (core.js:11691)
at ComponentFactory_.push../node_modules/@angular/core/fesm5/core.js.ComponentFactory_.create (core.js:9513)
at ComponentFactoryBoundToModule.push../node_modules/@angular/core/fesm5/core.js.ComponentFactoryBoundToModule.create (core.js:3489)
at new OAuthService (oauth-service.js:29)
at _createClass (core.js:9262)
at _createProviderInstance$1 (core.js:9234)
at resolveNgModuleDep (core.js:9200)
at NgModuleRef_.push../node_modules/@angular/core/fesm5/core.js.NgModuleRef_.get (core.js:9911)
at resolveDep (core.js:10276)
at createClass (core.js:10152)
at _createProviderInstance (core.js:10133)
at createProviderInstance (core.js:10016)
at createViewNodes (core.js:11242)
at createRootView (core.js:11169)
at callWithDebugContext (core.js:12204)
at Object.debugCreateRootView [as createRootView] (core.js:11691)
at ComponentFactory_.push../node_modules/@angular/core/fesm5/core.js.ComponentFactory_.create (core.js:9513)
at ComponentFactoryBoundToModule.push../node_modules/@angular/core/fesm5/core.js.ComponentFactoryBoundToModule.create (core.js:3489)
at resolvePromise (zone.js:710) [angular]
at resolvePromise (zone.js:681) [angular]
at :8086/polyfills.js:3474:17 [angular]
at Object.onInvokeTask (core.js:4053) [angular]
at drainMicroTaskQueue (zone.js:591) [<root>]
```
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 34.623 s
[INFO] Finished at: 2018-01-03T09:38:01Z
[INFO] Final Memory: 22M/308M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.springframework.boot:spring-boot-maven-plugin:1.5.8.RELEASE:run (default-cli) on project spring-security-oauth-ui-password-angular4: Unable to find a suitable main class, please add a 'mainClass' property -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.springframework.boot:spring-boot-maven-plugin:1.5.8.RELEASE:run (default-cli) on project spring-security-oauth-ui-password-angular4: Unable to find a suitable main class, please add a 'mainClass' property
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:213)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:154)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:146)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:51)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:309)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:194)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:107)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:955)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:290)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:194)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
Caused by: org.apache.maven.plugin.MojoExecutionException: Unable to find a suitable main class, please add a 'mainClass' property
at org.springframework.boot.maven.AbstractRunMojo.getStartClass (AbstractRunMojo.java:387)
at org.springframework.boot.maven.AbstractRunMojo.execute (AbstractRunMojo.java:181)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:134)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:208)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:154)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:146)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:51)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:309)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:194)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:107)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:955)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:290)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:194)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
[ERROR]
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Hi, THis is not an Issue , A question after reading your blog post.
You have mentioned that "Youโll notice that the client credentials are exposed to the front end โ which is something weโll address in a future article."
Can you guide me how can we make password grant without exposing client credentials , I am not using implicit grant , so i do not want o expose client credentials to my my mobile apps. Have you written mentioned future article?
Hello,
for me and bei colleagues is the spring-security-oauth-ui-implicit-angular4 Angular App not working. The other passwort Angular App is working.
Can you look at this problems?
This is what I get when I start the application with "npm start":
I already fixed one problem. I added the HttpClientModule in the app.module.ts.
Kind Regards
Michael
Hi. I found bug. Unfortunately your application does not authenticate user itself. I tried to enter the wrong password for user admin and found that spring security does not actually deal with authentication of user.
So i entered the application with wrong password. Could you please fix this.
I am trying to test the project with a mysql database.
Can anyone tell me the exact step in order to proceed from the master ?
I have read the guide more than once, I still can't have a stable login token.
The login work once at first authentication for a user, then the refreshToken is always refused.
A branch with a demo mysql working implementation would be great.
Edit :
I have created a fork kopax/spring-security-oauth
This fork as been created in order to demonstrate the jdbc token store functionality.
Error are reported at the end.
Import project in Eclipse
/workspace/github.com/kopax/spring-security-oauth
as a workspaceOpen projects from File System
./workspace/github.com/kopax/spring-security-oauth
, keep all the Folder checked for import and click Finish, this will load all the project into your workspace.Create the database
You will need to run on your host the following mysql instance :
hostname: localhost
port: 3306
name: oauth2
user: tutorialuser
pass: tutorialmy5ql
Run services
You will want to run the following app with the following server settings:
spring-security-oauth-resource
spring-security-oauth-server
spring-security-oauth-ui-password
Note: this are default configuration and should not be changed, just be sure to have 8082,8081,8084 free in order to complete the run.
Run > Debug configurations
...Display in favorites menu
, click Apply.Test services by doing the following command:
Resource:
$ curl http://localhost:8082/spring-security-oauth-resource/
{"error":"unauthorized","error_description":"Full authentication is required to access this resource"}
Authorization:
$ curl http://localhost:8081/spring-security-oauth-server/oauth/token
{"timestamp":1474968011125,"status":401,"error":"Unauthorized","message":"Full authentication is required to access this resource","path":"/spring-security-oauth-server/oauth/token"}
Client angular:
$ curl -X POST http://localhost:8084/oauth/token
{"error":"invalid_request","error_description":"Missing grant type"}
Database:
$ mysql -h localhost -u tutorialuser -ptutorialmy5ql -P3306 -D oauth2 -e "show tables;"
+----------------------+
| Tables_in_DATA_V1 |
+----------------------+
| ClientDetails |
| oauth_access_token |
| oauth_approvals |
| oauth_client_details |
| oauth_client_token |
| oauth_code |
| oauth_refresh_token |
+----------------------+
You now have validated the environment, let's do the testing:
Start Google chrome and go on the client interface:
Go into Incognito
in order to have a clean cookie and cache sandbox.
http://localhost:8084 , you should see the login form
Press F12 to open the developer tools, go under Network tab and click on Preserve log
and check XHR filter
Now refresh the view by pressing F5
Under the Resources tab in the developer tools, verify the non presence of cookie for localhost, if you do have, please restart chrome and go back into Incognito mode then try again.
By doing refresh, under the Network tab, you will notice the login POST request automatically made to http://localhost:8084/oauth/token with a Status Code 400 OK
Try to login using the inMemory credentials of your choice :
Press login, you will now see a second POST request to http://localhost:8084/oauth/token containing the form data ({ client_id:fooClientIdPassword, grant_type:password, password:111, username:tom }), status code is 200 and you have a Set-Cookie in the response Header Set-Cookie:refreshToken=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJ0b20iLCJzY29wZSI6WyJmb28iLCJyZWFkIiwid3JpdGUiXSwib3JnYW5pemF0aW9uIjoidG9tV3lIYSIsImF0aSI6IjA5NjYyNGMzLTE4NzAtNGM2My05YTg4LTg0ODAwZGIzMDc3MiIsImV4cCI6MTQ3NzU2MDk1MCwiYXV0aG9yaXRpZXMiOlsiUk9MRV9BRE1JTiJdLCJqdGkiOiJlMGE1...1lMjA2MGFjMDNiYjMiLCJjbGllbnRfaWQiOiJmb29DbGllbnRJZFBhc3N3b3JkIn0.O0XUHm7ilf3ECg3AJS9ftMoLhhst_xbPOm8T_6GOTClF_Rw85qyXzE-6mYEMYrqIUMpMCFTsdNFbpRWolW9SBJLrwRuvTdMqtgAZstn0nQzmedJDBoFtJF5QcFgLuPqhn9yP_orVzGHwo_td_62w7XiFwz_4_tSeoXsSjs1Z_uoC_SXmNJ1VFG-m_TYgP_y6gLXYmmXrVQz7WMu9um0A708UoQc7UKJyrFXrlb7VLFq7Ni1yQy7uI9l2DjXGGiTKLzrsthQmAiBFi3VGp-Gozbf8a9D2huUq7H6pjQupX-kaQXZFs44n_rUZxGKdhtMZCGOkJzBL_Q-T_AayOtJg9w;Max-Age=2592000;path=/oauth/token;HttpOnly
Under your resources tab, you will now see the cookie : access_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJ0b20iLCJzY29wZSI6WyJmb28iLCJyZWFkIiwid3JpdGUiXSwib3JnYW5pemF0aW9uIjoidG9tV3lIYSIsImV4cCI6MTQ3NDk3MjU1MCwiYXV0aG9yaXRpZXMiOlsiUk9MRV9BRE1JTiJdLCJqdGkiOiIwOTY2MjRjMy0xODcwLTRjNjMtOWE4OC04NDgwMGRiMzA3NzIiL...lbnRfaWQiOiJmb29DbGllbnRJZFBhc3N3b3JkIn0.EDpo9nWEv9Ir_IJZ7fDkMRI59TVcfuKaaaMf1tu6zxuY-c4r_KAHXhU1gzCbTDsUoNFrtq9CHRzS9zNpB_RYbuboWEhTrPdL4qv01rH7dKYhQvrvYs6qQ9oxOtbSdR4O_96oCobnzIRVSLLX4cjUxPbRUjkKh7i5wYSDa2LMRF5hXO9_7WQA9bSWS0vYF2c35pCzXSkyw9PSssosz_zcy4YMCuMFA06RraRVfjZnLDYkYk0m23VjXG8vAUy7af_rcr410g4s_tbeK1NiyhO8icN_x_jDD9crjj7yp41J1D8zAj4maBsQothbhAtDlqR9RRJyVwlDGtgG-PjikeeRhQ
In bash, verify the presence of the access_token:
$ mysql -h localhost -u tutorialuser -ptutorialmy5ql -P3306 -D oauth2 -e "select user_name, refresh_token from oauth_access_token"
+-----------+----------------------------------+
| user_name | refresh_token |
+-----------+----------------------------------+
| tom | f70d26129315697031...658bd40e6a4 |
+-----------+----------------------------------+
$ mysql -h localhost -u tutorialuser -ptutorialmy5ql -P3306 -D oauth2 -e "select token_id from oauth_refresh_token"
+----------------------------------+
| token_id |
+----------------------------------+
| 4c5ce06fae38f09f5d9796314d46971b |
+----------------------------------+
From now on, we can think everything is working fine, we can't logout so we will just remove the cookie and restart again, under the Resources tab, remove all cookie for localhost then press F5, you will be on login.
Try to login using tom:111
, you will now see a POST to http://localhost:8084/oauth/token Status code 400
If you go and check your server log in eclipse, you will have the following error :
2016-09-27 16:44:23.429 INFO 5552 --- [nio-8081-exec-3] o.s.s.o.p.token.store.JdbcTokenStore : Failed to find refresh token for token eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJ0b20iLCJzY29wZSI6WyJmb28iLCJyZWFkIiwid3JpdGUiXSwib3JnYW5pemF0aW9uIjoidG9tekdOSyIsImF0aSI6IjVkZWVhY2RlLTIzYTEtNGQxMy1iM2JjLTM5OWFhYzBlZWZjMiIsImV4cCI6MTQ3NzU2MDk1MCwiYXV0aG9yaXRpZXMiOlsiUk9MRV9BRE1JTiJdLCJqdGkiOiJlMGE1ZDk5MS0yY2YyLTRlOGItOGZiN...jA2MGFjMDNiYjMiLCJjbGllbnRfaWQiOiJmb29DbGllbnRJZFBhc3N3b3JkIn0.c1rRT3DMjGhSOyvp6e6trCVp1TbBt_RFdco11KPbcG9OUjdN1sq_xnH0qOwGlUMx40pXwkCIS_NhnH_asvMz-5jKyXrYiUDNE5xyJww_DJctFNALyVxNo0Kjf5TDElmFLoXiUpLz_iUKbpKEIZqf1GmrXkJfVgFGk1J9ast6IoZGBPvH3lCxpHYKnzCjhTbPA-wCpzIrR_idVOATylwoCUknO6HxqNgnsH1YdlQ2J_2ZyxDP2qq_SNKOT9wqQ9zJpI7OjBZ-Woy_DRQrgpwdmSft5luDWIWcrraZ8eGsK1YgHUBxV1Fy1NUlFmvELF42ZAxOiXCbVTZftTdBXzltXw
2016-09-27 16:44:23.433 INFO 5552 --- [nio-8081-exec-3] o.s.s.o.provider.endpoint.TokenEndpoint : Handling error: InvalidGrantException, Invalid refresh token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJ0b20iLCJzY29wZSI6WyJmb28iLCJyZWFkIiwid3JpdGUiXSwib3JnYW5pemF0aW9uIjoidG9tekdOSyIsImF0aSI6IjVkZWVhY2RlLTIzYTEtNGQxMy1iM2JjLTM5OWFhYzBlZWZjMiIsImV4cCI6MTQ3NzU2MDk1MCwiYXV0aG9yaXRpZXMiOlsiUk9MRV9BRE1JTiJdLCJqdGkiO...GE1ZDk5MS0yY2YyLTRlOGItOGZiNy1lMjA2MGFjMDNiYjMiLCJjbGllbnRfaWQiOiJmb29DbGllbnRJZFBhc3N3b3JkIn0.c1rRT3DMjGhSOyvp6e6trCVp1TbBt_RFdco11KPbcG9OUjdN1sq_xnH0qOwGlUMx40pXwkCIS_NhnH_asvMz-5jKyXrYiUDNE5xyJww_DJctFNALyVxNo0Kjf5TDElmFLoXiUpLz_iUKbpKEIZqf1GmrXkJfVgFGk1J9ast6IoZGBPvH3lCxpHYKnzCjhTbPA-wCpzIrR_idVOATylwoCUknO6HxqNgnsH1YdlQ2J_2ZyxDP2qq_SNKOT9wqQ9zJpI7OjBZ-Woy_DRQrgpwdmSft5luDWIWcrraZ8eGsK1YgHUBxV1Fy1NUlFmvELF42ZAxOiXCbVTZftTdBXzltXw
Try to login with john:123, same problem, can't login, error 400.
The code modifications are minor, it's just switching on and off your comments.
I haven't connected any UserDetailsServices yet, but my intention are to implement this using mybatis, I hope this is not related and you can help me getting this sample to work, don't know if this could be related.
Thanks in advance for your help!
I want a simple setup and not deploy various servers. Can I run a JWT oauth endpoint based on a single server and port scenario?
@with the spring-security-oauth-server (port = 8081) and spring-security-oauth-resource (port = 8082) in place, does it mean at this point the API server is secured with OAuth strategy? At this point can I use a pure front-end such as Angular2 or React.js to replace the last two front end sprint boot module for the client side? @eugenp
curl "http://localhost:8081/spring-security-oauth-server/employee" -H "Authorization: Bearer $TOKEN" -si
return 302 Location: http://localhost:8081/spring-security-oauth-server/login
log says:
2017-09-13 10:42:49.381 INFO 2157 --- [nio-8081-exec-5] o.s.s.o.p.token.store.JdbcTokenStore : Failed to find access token for token 810917c4-bb75-431b-96aa-974685d907cd
thanks for your help!
When using the Zuul configuration from this project, the /oauth/token
endpoint becomes unavailable. The live tests communicate with all the services directly, which is unrealistic. When changing all the ports to 8080
like they should've been, you find the following error:
2019-04-16 11:46:12.524 DEBUG 25207 --- [nio-8080-exec-1] o.s.s.w.a.ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:176) ~[spring-security-oauth2-2.3.5.RELEASE.jar:na]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) ~[spring-security-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:117) ~[spring-boot-actuator-2.1.3.RELEASE.jar:2.1.3.RELEASE]
at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:106) ~[spring-boot-actuator-2.1.3.RELEASE.jar:2.1.3.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:200) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1415) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) ~[na:na]
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) ~[na:na]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
at java.base/java.lang.Thread.run(Unknown Source) ~[na:na]
I created this by doing the following:
/spring-security-oauth-master/oauth-resource-server-1/src/test/java/com/baeldung/live/PasswordFlowLiveTest.java
The obtainAccessToken()
function will always fail, since it suddently requires auth.
I'm still unsure how to resolve this, any help would be appreciated... Thanks.
I can't seem to locate the username/password to use for the angularjs/spring-security-oauth-ui-implicit sample. The readme.md doesn't include username/password. Please share the username/password so I can use the login to test things out.
Thank you,
Jon
Just as the title goes, the project spring-security-oauth-server
, It seems still using DefaultTokenServices
as AuthorizationServerTokenServices
impl instead of customize a new impl AuthorizationServerTokenServicesJWT
.
So, still create token using uuid instaed of jwt.
Hi, I built a project based on your project using the client credentials mode. And It's using BCryptPasswordEncoder to encrypt the client_secret, now I want to use the RSA to encrypt it, how can I achieve it?
What is license with that project, do I use it for my own project?
Thank you.
I can use token to access resource server 1&2 but can't access to security oauth server's employee(GET).
something wrong with me?
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.b.w.s.f.OrderedRequestContextFilter : Bound request context to thread: org.apache.catalina.connector.RequestFacade@781292c9
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/oauth/token']
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/employee'; against '/oauth/token'
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/oauth/token_key']
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/employee'; against '/oauth/token_key'
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/oauth/check_token']
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/employee'; against '/oauth/check_token'
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : No matches found
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 1 of 12 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 3 of 12 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 4 of 12 in additional filter chain; firing Filter: 'LogoutFilter'
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', GET]
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/employee'; against '/logout'
2018-06-21 23:32:20.637 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', POST]
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /employee' doesn't match 'POST /logout
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', PUT]
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /employee' doesn't match 'PUT /logout
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', DELETE]
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /employee' doesn't match 'DELETE /logout
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.util.matcher.OrRequestMatcher : No matches found
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 5 of 12 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /employee' doesn't match 'POST /login
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 6 of 12 in additional filter chain; firing Filter: 'DefaultLoginPageGeneratingFilter'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 7 of 12 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 8 of 12 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 9 of 12 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.a.AnonymousAuthenticationFilter : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@495884c5: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 10 of 12 in additional filter chain; firing Filter: 'SessionManagementFilter'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 11 of 12 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.security.web.FilterChainProxy : /employee?email=123 at position 12 of 12 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/employee'; against '/login'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/employee'; against '/oauth/token/revokeById/'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/employee'; against '/tokens/'
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /employee?email=123; Attributes: [authenticated]
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@495884c5: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
2018-06-21 23:32:20.639 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.access.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@ae3fdf8, returned: -1
2018-06-21 23:32:20.640 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.a.ExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124) ~[spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) ~[spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119) ~[spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter.doFilter(DefaultLoginPageGeneratingFilter.java:206) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) [spring-security-web-5.0.6.RELEASE.jar:5.0.6.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:109) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.7.RELEASE.jar:5.0.7.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.baeldung.config.CorsFilter.doFilter(CorsFilter.java:32) [classes/:na]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1468) [tomcat-embed-core-8.5.31.jar:8.5.31]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.31.jar:8.5.31]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_162]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_162]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.31.jar:8.5.31]
at java.lang.Thread.run(Thread.java:748) [na:1.8.0_162]
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.util.matcher.AndRequestMatcher : Trying to match using NegatedRequestMatcher [requestMatcher=Ant [pattern='//favicon.ico']]
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/employee'; against '//favicon.ico'
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.NegatedRequestMatcher : matches = true
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.util.matcher.AndRequestMatcher : Trying to match using NegatedRequestMatcher [requestMatcher=MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.ContentNegotiationManager@76fe3b10, matchingMediaTypes=[application/json], useEquals=false, ignoredMediaTypes=[/]]]
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.m.MediaTypeRequestMatcher : httpRequestMediaTypes=[application/json, text/plain, /]
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.m.MediaTypeRequestMatcher : Processing application/json
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.m.MediaTypeRequestMatcher : application/json .isCompatibleWith application/json = true
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.u.matcher.NegatedRequestMatcher : matches = false
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.util.matcher.AndRequestMatcher : Did not match
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.s.HttpSessionRequestCache : Request not saved as configured RequestMatcher did not match
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.a.ExceptionTranslationFilter : Calling Authentication entry point.
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.web.DefaultRedirectStrategy : Redirecting to 'http://localhost:8081/spring-security-oauth-server/login'
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@7db47ef0
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2018-06-21 23:32:20.641 DEBUG 14560 --- [nio-8081-exec-4] o.s.b.w.s.f.OrderedRequestContextFilter : Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade@781292c9
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.b.w.s.f.OrderedRequestContextFilter : Bound request context to thread: org.apache.catalina.connector.RequestFacade@781292c9
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/oauth/token']
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/oauth/token'
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/oauth/token_key']
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/oauth/token_key'
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/oauth/check_token']
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/oauth/check_token'
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.web.util.matcher.OrRequestMatcher : No matches found
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.security.web.FilterChainProxy : /login at position 1 of 12 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.security.web.FilterChainProxy : /login at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.security.web.FilterChainProxy : /login at position 3 of 12 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.security.web.FilterChainProxy : /login at position 4 of 12 in additional filter chain; firing Filter: 'LogoutFilter'
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', GET]
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/logout'
2018-06-21 23:32:20.647 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', POST]
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /login' doesn't match 'POST /logout
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', PUT]
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /login' doesn't match 'PUT /logout
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.web.util.matcher.OrRequestMatcher : Trying to match using Ant [pattern='/logout', DELETE]
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /login' doesn't match 'DELETE /logout
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.web.util.matcher.OrRequestMatcher : No matches found
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.security.web.FilterChainProxy : /login at position 5 of 12 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.w.u.matcher.AntPathRequestMatcher : Request 'GET /login' doesn't match 'POST /login
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.security.web.FilterChainProxy : /login at position 6 of 12 in additional filter chain; firing Filter: 'DefaultLoginPageGeneratingFilter'
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@7db47ef0
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2018-06-21 23:32:20.650 DEBUG 14560 --- [nio-8081-exec-5] o.s.b.w.s.f.OrderedRequestContextFilter : Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade@781292c9
any user have to be authenticated to access any urls.
how to make some urls accessed without access_token(authentcation) in the resource server
TypeError: Cannot read property 'glob' of null
at ObjectSchemaTreeNode._set (/Users/aliakbarazizkhani/git/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources/node_modules/@ngtools/json-schema/src/schema-tree.js:226:132)
at new ObjectSchemaTreeNode (/Users/aliakbarazizkhani/git/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources/node_modules/@ngtools/json-schema/src/schema-tree.js:211:14)
at OneOfSchemaTreeNode._createChildProperty (/Users/aliakbarazizkhani/git/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources/node_modules/@ngtools/json-schema/src/schema-tree.js:150:26)
at OneOfSchemaTreeNode._typesPrototype.schema.oneOf.map (/Users/aliakbarazizkhani/git/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources/node_modules/@ngtools/json-schema/src/schema-tree.js:163:25)
at Array.map ()
at OneOfSchemaTreeNode (/Users/aliakbarazizkhani/git/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources/node_modules/@ngtools/json-schema/src/schema-tree.js:162:48)
at ArraySchemaTreeNode._createChildProperty (/Users/aliakbarazizkhani/git/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources/node_modules/@ngtools/json-schema/src/schema-tree.js:150:26)
at ArraySchemaTreeNode._set (/Users/aliakbarazizkhani/git/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources/node_modules/@ngtools/json-schema/src/schema-tree.js:288:39)
at new ArraySchemaTreeNode (/Users/aliakbarazizkhani/git/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources/node_modules/@ngtools/json-schema/src/schema-tree.js:269:14)
at ObjectSchemaTreeNode._createChildProperty (/Users/aliakbarazizkhani/git/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources/node_modules/@ngtools/json-schema/src/schema-tree.js:150:26)
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] start: ng serve --port 8086
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] start script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
npm ERR! A complete log of this run can be found in:
npm ERR! /Users/aliakbarazizkhani/.npm/_logs/2017-11-11T20_07_37_470Z-debug.log
Sorry submitted this to the wrong project
I'm successfully building and running the 'spring-security-oauth-server' server and obtaining access tokens. That said, the tokens aren't persisted in my MySQL database. The tables are created and client details are populated as expected, but no dice. Help?
hi
any reason to use SessionCreationPolicy.IF_REQUIRE in configure method of OAuth2ResourceServerConfigJwt?
Hi,
I am new to spring-boot, please answer my below question. Million thanks in advance..
In the Read-me file I see below details:
Make sure to run the project on port 8081
Run 4 sub-modules simultaneously
spring-security-oauth-server
spring-security-oauth-resource
spring-security-oauth-ui-implicit
spring-security-oauth-ui-password
But, how do I run all the above modules simultaneously. If I run individual module, only the first oauth-server would run, then it starts complaing about port already been used. So, I am confused how to run all the modules at one shot. Your help is appreciated.
In the oauth-ui-authorization-code-thymeleaf project, in the application.yml file
we have
authorization-grant-type: authorization_code
Tried to change it to password
but application don't start
In the oauth-authorization-server project, in the OAuth2AuthorizationServerConfigInMemory class (idem in the data.sql file), fooClientIdPassword client has every authorization grand types
so i don't understand why that fail
I am experiencing unexpected behaviour using Swagger-UI. This might not be a bug on your side.
curl -X GET "http://localhost:8082/spring-security-oauth-resource/users/extra" -H "accept: */*"
and
401
Error:
Response body
{
"error": "unauthorized",
"error_description": "Full authentication is required to access this resource"
}
Using OAuth2-Authentication in Postman works for this endpoint, because the Authorization-Header is set to "Bearer [token]" and yields:
{
"user_name": "admin",
"organization": "adminQAZa",
"authorities": [
"ROLE_ADMIN"
],
"jti": "46abcc9a-70b0-44a3-b513-f04531799954"
}
spring-security-oauth/spring-security-oauth-ui-implicit-angular4$ mvn clean install
spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources$ npm start
[email protected] start /media/dqvn/LDATA/Projects/Microservices/Oauth2/spring-security-oauth/spring-security-oauth-ui-implicit-angular4/src/main/resources
ng serve --port 8086
** NG Live Development Server is running on http://localhost:8086 **
Hash: fa0f47e16c2c88d3c23b
Time: 8177ms
chunk {0} polyfills.bundle.js, polyfills.bundle.js.map (polyfills) 183 kB {3} [initial] [rendered]
chunk {1} main.bundle.js, main.bundle.js.map (main) 11.4 kB {2} [initial] [rendered]
chunk {2} vendor.bundle.js, vendor.bundle.js.map (vendor) 3.17 MB [initial] [rendered]
chunk {3} inline.bundle.js, inline.bundle.js.map (inline) 0 bytes [entry] [rendered]
webpack: Compiled successfully.
I open the Chrome -> open localhost:8086 -> Press Login and then type admin / nimda as username and password -> submit
The Chrome console throw error:
ERROR Error: Uncaught (in promise): [object Object] (core.es5.js:1020)
at resolvePromise (zone.js:795)
at Function.ZoneAwarePromise.reject (zone.js:874)
at OAuthService.tryLogin (angular-oauth2-oidc.umd.js:904)
at new AppService (app.service.ts:26)
at createClass (core.es5.js:10931)
at _createProviderInstance (core.es5.js:10895)
at createProviderInstance (core.es5.js:10729)
at createViewNodes (core.es5.js:12187)
at createRootView (core.es5.js:12092)
at callWithDebugContext (core.es5.js:13475)
My environment is
Ubuntu 17.04
$ node -v
v6.11.3
$ npm -v
5.4.0
Please help me to solve this error
Received the following error: -bash-4.2$ mvn -Dhttp.proxyHost=<proxy> -Dhttp.proxyPort=port-Dhttps.proxyHost=<proxy> -Dhttps.proxyPort=port clean install [INFO] Scanning for projects... [ERROR] [ERROR] Some problems were encountered while processing the POMs: [FATAL] Non-resolvable parent POM for org.baeldung:oauth-ui-implicit-angular4:[unknown-version]: Could not find artifact org.baeldung:spring-security-oauth:pom:1.0.0-SNAPSHOT and 'parent.relativePath' points at wrong local POM @ line 10, column 10 @ [ERROR] The build could not read 1 project -> [Help 1] [ERROR] [ERROR] The project org.baeldung:oauth-ui-implicit-angular4:[unknown-version] (<home>/spring-security-oauth/clients-angular4/oauth-ui-implicit-angular4/pom.xml) has 1 error [ERROR] Non-resolvable parent POM for org.baeldung:oauth-ui-implicit-angular4:[unknown-version]: Could not find artifact org.baeldung:spring-security-oauth:pom:1.0.0-SNAPSHOT and 'parent.relativePath' points at wrong local POM @ line 10, column 10 -> [Help 2] [ERROR] [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException [ERROR] [Help 2] http://cwiki.apache.org/confluence/display/MAVEN/UnresolvableModelException
Problem is that there is not a relative path setting for the parent POM in this directory. I added this right below line 13 of the POM and it worked.
<relativePath>../../</relativePath>
The parent section of the POM now looks like this:
<parent> <groupId>org.baeldung</groupId> <artifactId>spring-security-oauth</artifactId> <version>1.0.0-SNAPSHOT</version> <relativePath>../../</relativePath> </parent>
Hi there,
either
return new IssuerClaimVerifier(new URL("http://localhost:8081/spring-security-oauth-server"));
or
return new IssuerClaimVerifier(new URL("http://localhost:8081"));
Tested in Postman.
Got access_token from http://localhost:8081/spring-security-oauth-server/oauth/token?grant_type=password&username=tom&password=111
then request http://localhost:8082/spring-security-5-oauth-resource/foos/1
bars/1 or any other request, no response with Status: 404 Not Found.
Could you please let me know how to make it work.
Appreciated!
It would be great if I can know the steps to configure the project to support https instead of http. May be this is not an issue, but i need some help.
Thanks.
-Sridhar
Thank you for this set of projects! You help me a lot!
Only a question, for a standalone angular project I need to use the implicit grant flow, is it correct? because otherwise I don't have a place to store safely the client secret.
Thank you,
Paolo
Hi,
I am trying to build the oauth-authorisation-server using gradle. When running the tests i get the following error:
com.baeldung.test.TokenRevocationLiveTest > whenObtainingAccessToken_thenCorrect FAILED java.lang.NoSuchMethodError at TokenRevocationLiveTest.java:34
this are my gradle dependencies:
testImplementation("junit:junit") testImplementation("org.assertj:assertj-core") testImplementation('io.rest-assured:rest-assured') testImplementation('org.springframework:spring-test') testImplementation('org.springframework.boot:spring-boot-test-autoconfigure') testImplementation('org.springframework.boot:spring-boot-starter-test') testImplementation('org.springframework.security:spring-security-test')
Is there something I am missing?
Thanks!
In this class the package is org.baeldung.live instead the file is located under org.baeldung.test
Hi and thanks for sharing this.
I remember myself following that tutorial long ago : https://www.baeldung.com/spring-security-oauth-jwt
I wanted to have the resource server and authorization server on the same app, so I wrote this:
ResourceServerConfig
:
@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
private AuthenticationEntryPoint authenticationEntryPoint;
@Autowired
private AccessDeniedHandler accessDeniedHandler;
@Autowired
private OAuth2Properties OAuth2Properties;
@Autowired
private TokenStore tokenStore;
@Override
public void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.anyRequest()
// .permitAll()
.access("#oauth2.hasScope('read') " +
"and #oauth2.clientHasRole('" + UserManagementRole.Constants.ROLE_AUTH_CLIENT_SERVICE + "') " +
"and hasAnyAuthority('" + UserManagementRole.Constants.ROLE_AUTH_SERVICE + "')")
.and()
.exceptionHandling()
.authenticationEntryPoint(authenticationEntryPoint)
.accessDeniedHandler(accessDeniedHandler);
}
@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
resources
.tokenServices(tokenServices())
.resourceId(OAuth2Properties.getResource().getName());
}
@Bean
@Primary
public ResourceServerTokenServices tokenServices() throws SQLException {
final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
defaultTokenServices.setTokenStore(tokenStore);
defaultTokenServices.setSupportRefreshToken(true);
defaultTokenServices.setAuthenticationManager(authenticationManager);
return defaultTokenServices;
}
}
And AuthorizationServerConfig
:
/**
* OAuth authorization server configuration
* We import service individually to avoid Circular dependency injection issue due to ResourceServer also configured in the same package
*/
@Configuration
@EnableAuthorizationServer
@Import({
UserManagementDbConfig.class,
ClientServiceImpl.class,
RoleServiceImpl.class,
LdapRoleServiceImpl.class,
OrganizationServiceImpl.class,
LdapOrganizationServiceImpl.class,
UserServiceImpl.class,
LdapOuUserServiceImpl.class,
SiteServiceServiceImpl.class,
SiteFunctionServiceImpl.class,
SiteContentServiceImpl.class,
})
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
private static final Logger log = LoggerFactory.getLogger(AuthorizationServerConfig.class);
@Autowired
@Qualifier(DATA_SOURCE)
private DataSource dataSource;
@Autowired
@Qualifier(AUTHENTICATION_MANAGER)
private AuthenticationManager authenticationManager;
@Autowired
private LocalOrgLdapUserDetailsManager userDetailsService;
@Autowired
private ClientService clientService;
@Autowired
private AuthenticationEntryPoint authenticationEntryPoint;
@Autowired
private AccessDeniedHandler accessDeniedHandler;
@Autowired
private OAuth2Properties oAuth2Properties;
// @Autowired
private TokenEnhancer tokenEnhancer;
@Autowired
private Environment env;
@Autowired
public void setTokenEnhancer(TokenEnhancer tokenEnhancer) {
this.tokenEnhancer = tokenEnhancer;
}
@Bean
public ClientDetailsService clientDetailsService() {
return new ClientDetailsService(clientService);
}
@Override
public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
oauthServer
.passwordEncoder(passwordEncoder())
.tokenKeyAccess("permitAll()")
.checkTokenAccess("isAuthenticated()")
.authenticationEntryPoint(authenticationEntryPoint)
.accessDeniedHandler(accessDeniedHandler);
}
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.withClientDetails(clientDetailsService());
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
final TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer, accessTokenConverter()));
endpoints
.tokenStore(tokenStore())
.approvalStoreDisabled()
.authorizationCodeServices(authorizationCodeServices())
.tokenEnhancer(tokenEnhancerChain)
.reuseRefreshTokens(false)
.authenticationManager(authenticationManager)
.userDetailsService(userDetailsService);
}
@Bean(name = "clientPasswordEncoder")
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public JwtAccessTokenConverter accessTokenConverter() {
final JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
if (null != oAuth2Properties.getAuthorization().getJks()) {
try {
ClassPathResource jks = new ClassPathResource(oAuth2Properties.getAuthorization().getJks());
final KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(jks, oAuth2Properties.getAuthorization().getJkspass().toCharArray());
converter.setKeyPair(keyStoreKeyFactory.getKeyPair(oAuth2Properties.getAuthorization().getAlias()));
} catch (Exception e) {
log.warn("Authorization server does not have certificate ! The jks file " + oAuth2Properties.getAuthorization().getJks() + " does not exist in your classpath.");
}
}
return converter;
}
@Bean
public TokenEnhancer tokenEnhancer() {
return this.tokenEnhancer;
}
@Bean
public TokenStore tokenStore() throws SQLException {
// if (Arrays.asList(env.getActiveProfiles()).contains("test")) {
// return new JwtTokenStore(accessTokenConverter());
// }
return new JdbcTokenStore(dataSource);
}
@Bean
protected AuthorizationCodeServices authorizationCodeServices() throws SQLException {
return new JdbcAuthorizationCodeServices(dataSource);
}
}
This is still working. But now I am creating a new app and after looking how to generate a new JKS
for that app, I realized that my jks configuration is useless.
So I have those questions:
JKS
if it work without it?run resource-server got the following error:
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.lang.NoClassDefFoundError: javax/xml/bind/JAXBException
I'm using spring boot 2.1.4
the tokenStore.findTokensByClientId() don't get users that have an expired access token but have a valid refresh token (so they can get an access token any time)
I'm want to user that application get a list of logged in users on my Rest Service that is secured with Oauth2(using access/refresh token)
This happens only when the user (that have an expired access token and a valid refresh token) tries to access a secured page with his expired access token at that moment he get an ivalid token (expired) error but also the tokenStore.findTokensByClientId() no longer find it, so in theory he is still logged in (he just need to get a new access token with his refresh token) but he is invisible for that function
I don't think it's a bug or something but that function was the only thing I can find to get a list of logged in users to my Oauth2 secured Rest Service.
Anyone has an idea of what I can do to get a list of user that still have a valid refresh token ?
I'm running default configuration for modules spring-security-5-oauth-resource, spring-security-oauth-server and spring-security-oauth-ui-password, but everytime I try to login using UI it says Invalid credentials, seems more like an issue with module.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.