3

I succesfully added user_id additionnal information on the generated tokens on the authorization server side by implementing a TokenEnhancer. Here is a token generated:

{"access_token":"ccae1713-00d4-49c2-adbf-e699c525d53e","token_type":"bearer","expires_in":31512,"scope":"end-user","user_id":2}

Now, on the Resource server side, which is a completely separate spring project communicating through a RemoteTokenServices, i would like to use theses informations with method expression-based access control. For example i would like to use the added user_id data (it is Spring Data JPA repository for use with Spring Data Rest):

@PreAuthorize("#oauth2.hasScope('admin') or #id == authentication.principal.user_id") @Override UserAccount findOne (@P("id") Integer id);

The #oauth2.hasScope('admin') works as expected but the #id == authentication.principal.user_id" part obviously not.

how can i access to the additional data added to the token on expression-based access control ?

1 Answer 1

10

So i've found myself. The key interface is UserAuthenticationConverter.

Using the default provided DefaultUserAuthenticationConverter class, we can set a UserDetailsService which is used to set authentication.principal with the UserDetail object returned by the UserDetailsService. Without that, authentication.principal is only set with the token username as a String.

Here is an extract of my ResourceServerConfigAdapter:

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration 
        extends ResourceServerConfigurerAdapter {

    @Bean
    UserDetailsService userDetailsService () {
        return new UserDetailsServiceImpl();
    }

    @Bean
    public UserAuthenticationConverter userAuthenticationConverter () {
        DefaultUserAuthenticationConverter duac 
            = new DefaultUserAuthenticationConverter();
        duac.setUserDetailsService(userDetailsService());
        return duac;
    }

    @Bean
    public AccessTokenConverter accessTokenConverter() {
        DefaultAccessTokenConverter datc 
            = new DefaultAccessTokenConverter();
        datc.setUserTokenConverter(userAuthenticationConverter());
        return datc;
    }

    @Bean
    RemoteTokenServices getRemoteTokenServices () {
        RemoteTokenServices rts = new RemoteTokenServices();
        rts.setCheckTokenEndpointUrl(
            "http://localhost:15574/oauth/check_token");
        rts.setAccessTokenConverter(accessTokenConverter());
        rts.setClientId("client");
        rts.setClientSecret("pass");
        return rts;
    }

    ...

}

Another method is to override the DefaultUserAuthenticationManager and provide a custom public Authentication extractAuthentication(Map<String, ?> map).

Once this is done, we can use the user data on expression-based access control like that:

@PreAuthorize("#oauth2.hasScope('admin') or #id == authentication.principal.userAccount.id")
@Override
UserAccount findOne (@P("id") Integer id);

Note that userAccount is my original DOMAIN user object. It could be everything the UserDetailsService returns.

EDIT: To answer to Valentin Despa, here is my UserDetailsService implementation:

@Component
public class UserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    UserAccountRepository userAccountRepository;

    public UserDetails loadUserByUsername (String username) 
            throws UsernameNotFoundException {

        // Fetch user from repository
        UserAccount ua = this.userAccountRepository
            .findByEmail(username);

        // If nothing throws Exception
        if (ua == null) {
            throw new UsernameNotFoundException(
                "No user found having this username");
        }

        // Convert it to a UserDetails object
        return new UserDetailsImpl(ua);

    }

}
5
  • Thanks for sharing. How does your UserDetailsServiceImpl look like? Nov 29, 2016 at 10:59
  • 1
    I added my UserDetailsServiceImpl to the answer. Nov 29, 2016 at 12:17
  • Thanks for the fast reply. Nov 29, 2016 at 12:18
  • Is your resource server and authorization server pointing to same database?
    – 027
    Jul 5, 2017 at 11:44
  • Thanks @tiben. just implemented the way you suggested, and its working. in my case, the resource server and auth-server are pointing to different database.
    – imdzeeshan
    Aug 8, 2017 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.