This is a follow-up to an earlier question.
I am attempting to migrate an OAuth2 application to Spring Boot 2 / Security 5. According to one of the comments in my earlier question (and this), it appears as if the storage format for passwords is changing.
In my original (Spring 1.5.9) application, I had explicitly specified BCrypt
// AppConfig
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
// SecurityConfig
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userService)
.passwordEncoder(passwordEncoder);
}
This resulted in an error that the password "did not look like BCrypt (the reason for my earlier question).
Thanks to a comment in response to my earlier question, it seemed as if I would need to prefix the stored password with {bcrypt}. I also replaced my PassowrdEncoder @Bean
with:
PasswordEncoder passwordEncoder =
PasswordEncoderFactories.createDelegatingPasswordEncoder();
However, this resulted in the following error:
java.lang.IllegalArgumentException: There is no PasswordEncoder mapped for the id "null"
Next, I tried changing the @Bean
to the following:
@Bean
public PasswordEncoder passwordEncoder() {
String idForEncode = "bcrypt";
Map encoders = new HashMap<>();
encoders.put(idForEncode, new BCryptPasswordEncoder());
encoders.put("pbkdf2", new Pbkdf2PasswordEncoder());
encoders.put("scrypt", new SCryptPasswordEncoder());
return new DelegatingPasswordEncoder(idForEncode, encoders);
}
This resulted in the same error. The user creation part seems to work as expected. Running the following:
@Bean
public CommandLineRunner demo(UserRepository repository) {
return(args) -> {
OAuthUser user = new OAuthUser();
user.setFirstName("K");
user.setLastName("M");
user.setPassword(passwordEncoder.encode("L"));
user.setUserName("KLM");
repository.save(user);
};
}
results in a user with the password {bcrypt}$2a$10$p/W7UV.fkghBRMzuDhh7z.G0uPLze9yFMLarbHdmwinzlqAHrMUQi
.
However, user validation fails. Issuing this request:
curl --request POST \
--url http://web:secret@localhost:8090/oauth/token \
--header 'content-type: multipart/form-data; boundary=---011000010111000001101001' \
--form grant_type=password \
--form username=KLM \
--form 'pasword =L'
gives the "message": "There is no PasswordEncoder mapped for the id \"null\"" message.
First, any suggestions as to what the issue might be would be appreciated.
Second, concerning the migration to the new storage format, I have another inquiry. Is this storage format, that is, {id]password
, a standard or something Spring specific? Basically, in the past, if a password were stored as BCrypt, I could presumably validate the password from C# or another application. All the application needed to know was how to handle the BCrypt standard. Will this new storage format inhibit the ability of validating the user through a non-Spring application or not?
Thanks.
EDIT:
I eventually got Spring Boot 2 / Security 5 to work with OAuth2. While I cannot recall the exact steps (I have been working on a few Spring projects off and on), I am posting what are hopes are my relevant bit of configuration to act as a guide.
Ensure you add a password encoder bean:
@Bean
public PasswordEncoder passwordEncoder() {
return PasswordEncoderFactories.createDelegatingPasswordEncoder();
//return new BCryptPasswordEncoder();
}
For the authorization server, ensure you reference both in the AuthorizationServerSecurityConifgurer
and ClientDetailsServiceConfigurer
sections.
@EnableAuthorizationServer
@Configuration
public class AuthConfig extends AuthorizationServerConfigurerAdapter {
// Some code omitted for brevity
@Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
security.passwordEncoder(passwordEncoder);
security.checkTokenAccess("permitAll()");
security.tokenKeyAccess("permitAll()");
}
@Override
public void configure(ClientDetailsServiceConfigurer configurer) throws Exception {
JdbcClientDetailsService details = new JdbcClientDetailsService(appConfig.dataSource());
details.setPasswordEncoder(passwordEncoder);
configurer.withClientDetails(details);
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
TokenEnhancerChain enhancerChain = new TokenEnhancerChain();
endpoints.tokenStore(tokenStore).accessTokenConverter(converter)
.userDetailsService(userService)
.authenticationManager(authenticationManager);
}
In the SecurityConfig, ensure you register it with AuthenticationManagerBuilder.
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userService).passwordEncoder(passwordEncoder);
}
Make sure you configure your ResourceServer
, including the HttpSecurity endpoints.
EnableResourceServer
@Configuration
public class ResourceConfig extends ResourceServerConfigurerAdapter {
private AppConfig appConfig;
@Autowired
private ResourceServerTokenServices tokenService;
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
public ResourceConfig(AuthenticationManager authenticationManager, AppConfig appConfig) {
this.authenticationManager = authenticationManager;
this.appConfig = appConfig;
}
@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
resources.resourceId("321");
resources.tokenServices(tokenService);
}
@Override
public void configure(HttpSecurity http) throws Exception {
http.headers().frameOptions().disable().and().requestMatchers().and().authorizeRequests()
.antMatchers("/user/**").hasAuthority("ROLE_ADMIN").antMatchers("/h2/**").permitAll();
}
I believe it is the @Config
classes that tend to be most relevant. There is nothing special about my UserDetailsService implementation and I did not think I even extended or customized the client in this app (outside from what is seen in the @Config).