7

This is a follow-up to an earlier question.

I am attempting to migrate an OAuth2 application to Spring Boot 2 / Security 5. According to one of the comments in my earlier question (and this), it appears as if the storage format for passwords is changing.

In my original (Spring 1.5.9) application, I had explicitly specified BCrypt

// AppConfig

   @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

// SecurityConfig

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {


auth.userDetailsService(userService)    
.passwordEncoder(passwordEncoder);
}

This resulted in an error that the password "did not look like BCrypt (the reason for my earlier question).

Thanks to a comment in response to my earlier question, it seemed as if I would need to prefix the stored password with {bcrypt}. I also replaced my PassowrdEncoder @Bean with:

PasswordEncoder passwordEncoder =
    PasswordEncoderFactories.createDelegatingPasswordEncoder();

However, this resulted in the following error:

java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id "null"

Next, I tried changing the @Bean to the following:

@Bean
public PasswordEncoder passwordEncoder() {

    String idForEncode = "bcrypt";
    Map encoders = new HashMap<>();
    encoders.put(idForEncode, new BCryptPasswordEncoder());

    encoders.put("pbkdf2", new Pbkdf2PasswordEncoder());
    encoders.put("scrypt", new SCryptPasswordEncoder());

    return new DelegatingPasswordEncoder(idForEncode, encoders);

}

This resulted in the same error. The user creation part seems to work as expected. Running the following:

    @Bean
    public CommandLineRunner demo(UserRepository repository) {
        return(args) -> {
            OAuthUser user = new OAuthUser();


            user.setFirstName("K");
            user.setLastName("M");
            user.setPassword(passwordEncoder.encode("L"));
            user.setUserName("KLM");

repository.save(user);
        };
    }

results in a user with the password {bcrypt}$2a$10$p/W7UV.fkghBRMzuDhh7z.G0uPLze9yFMLarbHdmwinzlqAHrMUQi.

However, user validation fails. Issuing this request:

curl --request POST \
  --url http://web:secret@localhost:8090/oauth/token \
  --header 'content-type: multipart/form-data; boundary=---011000010111000001101001' \
  --form grant_type=password \
  --form username=KLM \
  --form 'pasword =L'

gives the "message": "There is no PasswordEncoder mapped for the id \"null\"" message.

First, any suggestions as to what the issue might be would be appreciated.

Second, concerning the migration to the new storage format, I have another inquiry. Is this storage format, that is, {id]password, a standard or something Spring specific? Basically, in the past, if a password were stored as BCrypt, I could presumably validate the password from C# or another application. All the application needed to know was how to handle the BCrypt standard. Will this new storage format inhibit the ability of validating the user through a non-Spring application or not?

Thanks.

EDIT:

I eventually got Spring Boot 2 / Security 5 to work with OAuth2. While I cannot recall the exact steps (I have been working on a few Spring projects off and on), I am posting what are hopes are my relevant bit of configuration to act as a guide.

Ensure you add a password encoder bean:

    @Bean
    public PasswordEncoder passwordEncoder() {
return  PasswordEncoderFactories.createDelegatingPasswordEncoder();
        //return new BCryptPasswordEncoder();
    }

For the authorization server, ensure you reference both in the AuthorizationServerSecurityConifgurer and ClientDetailsServiceConfigurer sections.

  @EnableAuthorizationServer
@Configuration
public class AuthConfig extends AuthorizationServerConfigurerAdapter {

// Some code omitted for brevity

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security.passwordEncoder(passwordEncoder);
        security.checkTokenAccess("permitAll()");
        security.tokenKeyAccess("permitAll()");
    }


    @Override
    public void configure(ClientDetailsServiceConfigurer configurer) throws Exception {
        JdbcClientDetailsService details = new JdbcClientDetailsService(appConfig.dataSource());
        details.setPasswordEncoder(passwordEncoder);

        configurer.withClientDetails(details);
    }


    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        TokenEnhancerChain enhancerChain = new TokenEnhancerChain();
        endpoints.tokenStore(tokenStore).accessTokenConverter(converter)
        .userDetailsService(userService)
        .authenticationManager(authenticationManager);
    }

In the SecurityConfig, ensure you register it with AuthenticationManagerBuilder.

@Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder);
    }

Make sure you configure your ResourceServer, including the HttpSecurity endpoints.

EnableResourceServer
@Configuration
public class ResourceConfig extends ResourceServerConfigurerAdapter {

    private AppConfig appConfig;

    @Autowired
    private ResourceServerTokenServices tokenService;

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    public ResourceConfig(AuthenticationManager authenticationManager, AppConfig appConfig) {
        this.authenticationManager = authenticationManager;
        this.appConfig = appConfig;
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId("321");
        resources.tokenServices(tokenService);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.headers().frameOptions().disable().and().requestMatchers().and().authorizeRequests()
                .antMatchers("/user/**").hasAuthority("ROLE_ADMIN").antMatchers("/h2/**").permitAll();

    }

I believe it is the @Config classes that tend to be most relevant. There is nothing special about my UserDetailsService implementation and I did not think I even extended or customized the client in this app (outside from what is seen in the @Config).

8
  • that link about migration starts with "If you are not using an explicit PasswordEncoder or were relying on the old core PasswordEncoder you will need to migrate." - and you had explicit passwordencoder, so wouldn't that mean you don't need to migrate? So this seems essentially the same question you already had, not a new one
    – eis
    Commented Mar 12, 2018 at 13:47
  • I agree that, in a sense, I should not have to migrate, but I am also trying to look forward (the app is not currently in production so I figured it might be to good to start with Security 5) However, the above changes (to the PasswordEncoder bean), to my understanding should have alleviated the issues anyway. That is, it is encoding it according to the new format and and should thus be able to decode it appropriately. Thanks.
    – KellyM
    Commented Mar 12, 2018 at 13:53
  • Hi, did you figure out this issue? I am getting similar error if id null. I am following the same coding pattern you have described. Thanks
    – Jimmy
    Commented Apr 4, 2018 at 14:00
  • @James I do not have the code in front of me at the moment, but I believe it had to do with the client ("secret" in the example), rather than the user, password. Before Security 5 / Spring Boot 2, it was content to accept a plain text password. Now, It seems as if you might have to either encode the client password (and prepend it with {id}) or, alternatively, prepend {noop} to it.
    – KellyM
    Commented Apr 4, 2018 at 22:57
  • Yes, so I am enconding the user's password at the time of registration with {id} and in database I can see the encrypted password. I am having issues while doing authentication. Do I need to do anything while authenticating?
    – Jimmy
    Commented Apr 5, 2018 at 5:10

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.