1

I'm setting up a REST API server which should work only with client_credentials flow, so I have no users but only clients to access my resources.

I'm using SPRING BOOT PARENT 2.0.2.RELEASE and Spring Security Oauth2 2.3.4.RELEASE

When trying to get the token i keep receiving this error:

There is no client authentication. Try adding an appropriate authentication filter.

This is how i configure my AuthServer

@Configuration
@EnableAuthorizationServer
public class AuthServer extends AuthorizationServerConfigurerAdapter {

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Autowired
    ClientDetailsService clientDetailsService;

    @Override
    public void configure(
      AuthorizationServerSecurityConfigurer oauthServer) 
      throws Exception {
        oauthServer
        .allowFormAuthenticationForClients()
          .tokenKeyAccess("permitAll()")
          .checkTokenAccess("isAuthenticated()");
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) 
      throws Exception {
        clients.inMemory()
          .withClient("client")
          .secret("{noop}secret")
          .authorizedGrantTypes("refresh_token", "client_credentials")
          .scopes("read", "write");
    }

    @Override
    public void configure(
      AuthorizationServerEndpointsConfigurer endpoints) 
      throws Exception {

        endpoints
          .tokenStore(tokenStore())
          .authenticationManager(authenticationManager)
          .setClientDetailsService(clientDetailsService)

    }

    @Bean
    public TokenStore tokenStore() {
        return new InMemoryTokenStore();
    }
}

This is how i set the general Security

@Configuration
@EnableWebSecurity

@Order(-1)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {


    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
        .authorizeRequests()
        .antMatchers("/oauth/token").permitAll()
        .and()
        .csrf().disable()
        .httpBasic().disable();

    }

      @Bean
             @Override
             public AuthenticationManager authenticationManagerBean() throws Exception {
                     return super.authenticationManagerBean();
           }

}

and finally the ResourceServer (which should not be important in this issue)

@Configuration
@EnableResourceServer
public class ResourceServerConf extends ResourceServerConfigurerAdapter{


    @Override
    public void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
        .antMatchers("/api*")
        .authenticated();

    }

}

I try to get the token with a POST call to /oauth/token in this way oauth/token?client_id=client&client_secret=secret&grant_type=client_credentials

What do i miss?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.