I have created an Authorization service as follows
@SpringBootApplication
@EnableAuthorizationServer
public class AuthorizationApplication {
...
}
With this application.properties
.
server.port=9000
security.oauth2.client.client-id=monederobingo
security.oauth2.client.client-secret=monederobingosecret
security.oauth2.client.authorized-grant-types=authorization_code,refresh_token,password,client_credentials
security.oauth2.client.scope=company,client
Then, in a separate spring boot project I have created a Resource Server.
@SpringBootApplication
@EnableResourceServer
public class App {
...
}
With this application.properties
.
server.port=9090
spring.application.name=app
security.oauth2.resource.user-info-uri=http://localhost:9000/user
Now, everything works fine if I send a request like this localhost:9090/api
with the appropriate token that was retrieved by Authorization Service.
However, I don't want to send this token when sending requests to localhost:9090/login
.
For this I have created this class in my Resource server spring boot app.
@Configuration
public class SpringConfig extends WebSecurityConfigurerAdapter {
@Override protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/login")
.permitAll()
.antMatchers("/api/**")
.authenticated();
}
}
And now I don't need to send any token to send a request to /login
.
However, I'm now geting the following message when sending request to /api
with a valid token.
{
"timestamp": 1496027102659,
"status": 403,
"error": "Forbidden",
"message": "Access Denied",
"path": "/api/v1/points_configuration/314"
}
How can configure security for only a few URL patterns in Spring Security OAuth2?
SpringConfig
class. – alayor May 29 '17 at 3:35ResourceServerConfigurerAdapter
instead ofWebSecurityConfigurerAdapter
? – alayor May 29 '17 at 15:11