Questions tagged [spring-security-oauth2]
Spring Security's deprecated implementation of the OAuth2 spec. For OAuth2 with Spring Security 5 use Spring Security tag. We don't get many questions on OAuth 1(a) but feel free to tag them here.
3,164
questions
0
votes
0
answers
9
views
oauth2login with ressourceServer
i have this configuration for my security chain filter:
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
return httpSecurity
....
0
votes
0
answers
41
views
OAuth2 for Spring Security, oauth/token endpoint customisation
Since documentation is gone I'm facing issues with token endpoint customisation.
I'm only interested in 2 grants: password, client_credentials.
It must be localhost:8080/myapp/oauth/token otherwise I ...
0
votes
0
answers
46
views
spring-security-oauth2 migration to spring-security 5 or above guide
As some classes or features are deprecated or removed from spring-security-oauth2 library, need to change those codes. But there seems no useful information for this migration. From source code got ...
0
votes
1
answer
37
views
Spring Security OAuth resourceserver can only configure itself through the issuer-uri
I am using docker to deploy an application with:
an nginx container terminating SSL
a Keycloak container
a Spring Boot OAuth resource server.
I have the following configuration:
security:
...
0
votes
0
answers
57
views
Spring Security login problem after migration Spring Boot version 1.5 to version 2.2: HTTP Error code 302
I'm migrating from Spring Boot 1.5 to Spring Boot 2.2.4 . I would like to keep for the moment the authentication that was implemented in version 1.5 . I have problems with authentication, when I log ...
-1
votes
1
answer
77
views
OAuth2RestTemplate not refreshing the oauth token upon expiry with Spring Boot 2.7.6
I am using Spring-Boot 2.7.6 with Spring-Cloud 2021.0.5 application running on VMWare Tanzu,
Using OAuth2RestTemplate for authenticating my APIs with Hybris/SAP Commerce application via Feign client.
...
0
votes
0
answers
41
views
Trying to get OAuth2 token from Azure server from Java
Hi have these below details which are working fine from Postman but I need to retrieve the Oauth2 token from Java.
ClientId : clientid-abcd-bcda-xxxx-bbbbc-bbbbsjhk
clientsecret: client-secret-xxxx-...
0
votes
0
answers
404
views
OpenApi 3 Swagger UI not working on Spring 2.7.12 with Spring Security Oauth 2
I have upgraded my spring version to 2.7.12 and migrating from springfox swagger 2 to springdoc openapi 3 (swagger 3). The swagger config api is working fine but due to webMVCConfig in my application ,...
0
votes
3
answers
601
views
Spring OAuth2 Client - authorization code exchange fails
Suppose we have a confidential OAuth2 Client performing authorization against the Authorization Server using authorization code grant type.
Here's a minimal reproducible example.
Client application is ...
-1
votes
1
answer
299
views
"Error starting Spring Boot application", only when trying 'docker-compose up'. Issue with spring-security-oauth2-authorization-server
I'm encountering an error while trying to execute docker-compose up with my Spring Boot application. The error message indicates that an attempt was made to call a method that does not exist. However, ...
0
votes
0
answers
75
views
devtools and Spring Security makes Spring Boot application fail to start
When I use spring-boot-devtools and Spring Security at the same time, the application fails to start. I have been try to exclude UsernamePasswordAuthenticationToken.class in spring-devtools.properties ...
0
votes
0
answers
168
views
Issue with using org.springframework.security.oauth:spring-security-oauth2 Java SDK while migrating from Spring 5 to Spring 6
We plan to migrate to Spring 6 from Spring 5 and were using spring-security-oauth2:2.5.1 library.
Now with Spring 6, since we need to use Jakarta namespace and spring-security-oauth2 latest 2.5.2 ...
0
votes
1
answer
110
views
Spring MVC OAUTH2 with JWT Token xml configuration
I have already implemented oauth2 using DefaultTokenServices. This will return uuid for the access token and refresh token. I need to return JWT tokens instead.
Most resources point to spring boot ...
0
votes
1
answer
423
views
Oauth2: request custom claims on requesting access token
Is it possible to add custom claims into an access token at the moment of requesting that?
I mean, by default authorization server adds its claims, but in mu case, I'd like request an access token ...
0
votes
1
answer
42
views
Could not autowire. No beans of 'AuthorizationServerTokenServices' type found. Spring OAuth2
I want to test OAuth2 authorization and like in this answer:
https://stackoverflow.com/questions/38326028/java-spring-mvc-integration-test-create-oauth2-principal
I'm trying to inject ...
-2
votes
1
answer
103
views
Roles based authorization using JWT token with Roles without verifying the token
I am getting a JWT token to the java back-end from the UI which contains "roles" in it. I am trying to implement role based authorization(secure the Rest APIs) using spring security using ...
0
votes
1
answer
408
views
Jackson Parse String to Map throws java.lang.IllegalArgumentException. Explicit mapping using Jackson annotations or by providing a Mixin for UUID
I am creating an authorization server using Spring Security OAuth2 authorization framework and I am trying to map the OidcIdTokenClaims (Given Below) to Map<String, Object>.
OidcIdTokenClaims ...
0
votes
0
answers
78
views
OAuth2AuthenticationToken not printing anything even after authentication
After loging in I am redirected to the redirect_uri with access token appended on the URL on the browser but i am not able to acces the access token and OAuth2AuthenticationToken is not populated ...
1
vote
1
answer
338
views
Spring in Kotlin, JWT Token encoded with base64url
I'm trying to create a JWT token with NimbusJwtEncoder, and I'm getting a token correctly. but each time i verify it on jwt.io it says that the signature is invalid, because it is not encoded ...
0
votes
0
answers
47
views
Keep user session active in spring authorization server
We created our OIDC authorization server using spring auth 1.0.0 version which is working as expected with no issue. Currently there are different types of applications that are integrated with our ...
-1
votes
1
answer
372
views
How to get the granted authorities/roles from custom OIDC claim using spring oidc/oauth2 (AWS cognito)
OK so I have a basic oauth2/oidc configuration in spring/spring boot. The authentication stuff all seems to be working reliably with minimal configuration until I attempt to access the roles. When I ...
0
votes
0
answers
91
views
Missing JTI from JWT using oath2 + OPENID
So I'm trying to set up an identity provider using spring security + spring-security-oauth2-authorization-server and for the most part it's going fine, but I can't seem to find how to enable the ...
0
votes
0
answers
121
views
How do I send an authenticated API request through spring-cloud-azure-starter-active-directory?
I have a React application and a Java Spring API that are both secured with Microsoft Active Directory.
UI uses MSAL libraries to login
Java Spring uses spring-cloud-azure-starter-active-directory to ...
0
votes
1
answer
77
views
NullPointerException at JBossServerAuthConfig.getAuthContext line 108
I'm using Spring Boot 2.7.9 to create a website along with Spring OAuth2 and Google Auth. When I try to access the site, I'm getting the above error. I've traced it back a bit, but would like to hear ...
0
votes
0
answers
135
views
How to get user's attribute in spring boot with keycloak
I want to keep user's custom properties in keycloak. I made some example attribute 'birthday' in keycloak, mapped there in client and get it in spring application:
private HashMap <String, Object&...
0
votes
0
answers
381
views
How to proper implement client_secret_jwt Token request customize DefaultClientCredentialsTokenResponseClient
I would like to implement client_secret_jwt client authentication. In the Spring security document it is said
To customize only the parameters of the request, you can provide ...
0
votes
1
answer
182
views
Spring Resttemplate with multiple Proxy host
I have to call an api which is only accessible via bunch of proxy server(set of servers are deployed and anyone can be active at give point of time ) . I am using following code to set the proxy to ...
0
votes
0
answers
239
views
Need to manually re-authorize using OAuth2AuthorizationRequest not working
I'm building a client application that need to be able to step-up a user in case the authentication level is not sufficient.
For this the resource server evaluates the access_token through ...
1
vote
1
answer
360
views
Spring Boot OAuth2 authentication with Google failing due to missing client_secret
I'm trying to implement OAuth2 authentication with Google in my Spring Boot Angular application, but I'm getting an "invalid_request" error with the message "client_secret is missing&...
0
votes
1
answer
802
views
Error authenticating after migrating to Spring Security 6 - (Missing client_secret) [closed]
I've been migrating my microsservices to Springboot 3.0.2, and now i have to use the spring security version 6, but i'm facing a problem when the request build the request body to OAuth Provider in ...
2
votes
0
answers
534
views
How to replace OAuth2 in Spring Boot 3?
I have read a lot about this topic but I have not found a solution to whether to replace what was used or create new methods or if there is a new dependency that can help me, referring to the ...
1
vote
1
answer
285
views
spring webclient caching OAuth token
Can we cache the OAuth token using spring webclient?, i have configured webclient as below, it is fetching the token for every request, is there any spring way to cache the token and refreshed only ...
0
votes
0
answers
37
views
Why should we use (if needed) SecurityFilterChain to validate JWT Token if OAuthResourceServer will do that anyway?
I know the question is very open ended but I am really not understanding why we need to check JWT structure and signatures in a filter if OAuth2ResourceServer will validate the token anyway?
0
votes
0
answers
21
views
0-legged oauth 1.0 signature validation in spring boot 2.6.7 version
I want to validate the oauth signature and nonce in my spring boot application using any dependency /library which supports for spring boot version 2.6.7.
Does anyone have any examples/tutorials for a ...
1
vote
1
answer
126
views
Spring Authorization Server use additional parameters from authorization request for login
So basically, what I want is that following request:
http://127.0.0.1:9000/oauth2/authorize?response_type=code&client_id=test-client&redirect_uri=http://127.0.0.1:8080/authorized&scope=...
0
votes
0
answers
62
views
Validate the oauth Signature which generated by 0-legged oauth 1.0 standard in spring boot 2.6.7
I need to validate the oauth Signature which generated by 0-legged oauth 1.0 standards.
All oauth parameters ( oauth_signature, ouath_timestamp ,oauth_nonce, oauth_consumer_key, oauth_signature_method,...
0
votes
0
answers
435
views
UsernamePasswordAuthenticationToken cannot be cast to class org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken
I am working on a spring boot application. The application has in-memory security authentication with some login details. From this application I want to access an API interface (to get user ...
0
votes
1
answer
361
views
How to append custom request header during Authorization endpoint call in Spring Boot OpenID Connect
I'm using spring 5.3.25. The Identity Provider implemented a security in authorization and token endpoint in OIDC such that the endpoints are expecting a certain request header value from the OIDC ...
0
votes
0
answers
195
views
Spring Authorization Server 1.0 Authorization Code PKCE
I've configured Spring Authorization server 1.0 which issues JWT tokens using Authorization_Code Grant PKCE. While I test it using Postman (pls see the screenshot), I am presented with the login ...
0
votes
0
answers
192
views
Snowflake OAuth with Spring boot Java Application
I have a Spring boot Java application (with Snowflake DB) which has React Js inside same JAR package. Now i want to use Snowflake OAuth for Single SIgn on.
As per Snowflake documentation, i created ...
0
votes
1
answer
34
views
Does Spring Authorization Server or OAuth2 client support passing request Parameters as JWTs
Does Spring Authorization Server or the Spring Security OAuth2 client support passing request Parameters as JWTs (see https://openid.net/specs/openid-connect-core-1_0.html#JWTRequests). Searching the ...
0
votes
0
answers
84
views
Spring Integration DSL - OAuth2ErrorHandler issues with 4XX series error codes
We are using spring integration DSL to call downstream services. But we are facing issues when 4XX series error code is returned by downstream service.
Below is the code snippet that we are using to ...
0
votes
1
answer
531
views
How to integrate Google SingIn react native and Spring Boot Security OAuth2?
I have a mobile app in react native that uses expo-auth-session to be able to log in with its google account.
I have spring boot application that has oauth2 configuration as you can see below:
spring:
...
0
votes
3
answers
407
views
Keycloak and SpringBoot
I started playing with Keycloak, but I have a question. While reading articles, I always found examples where a client (let's say Angular) is logging in on Keycloak, it gets a bearer and then it send ...
0
votes
0
answers
106
views
How do I use OAuth2AuthorizationCodeGrantFilter to associate an email address with its corresponding OAuth2AuthorizedClient?
I have a Spring-based webapp that uses JavaMail to send and process mail via SMPT/IMAP.
I now need to add support for OAuth2 authentication, initially for GMail.
The webapp already uses Spring ...
0
votes
0
answers
83
views
multiple access token from one spring boot oauth2 client
We have a set of APIs from two different resource servers. We need to call authorize endpoint for two resource servers as we can't combine the scopes in a single call. Is it possible in spring boot ...
0
votes
0
answers
116
views
spring boot oauth2 client manual access token refresh
I'm using spring boot oauth2 client for oauth2 purpose. Right now my application is automatically refreshing the access token after the token is expired as I'm using OAuth2AuthorizedClientManager. I ...
0
votes
1
answer
149
views
Use OAuth library for Spring Boot
I'm trying to include the oauth library in Spring Boot. I don't know why, but it doesn't seem to be working. In any case, I cannot use the following libraries:
ProtectedResourceDetails cannot be ...
0
votes
1
answer
210
views
Keycloak: resource rolebased acccess management
Input data:
eureka (localhost:8761)
spring boot cloud gateway service with keycloak (localhost:8765)
developer resource service (localhost:8082)
kecloak (localhost:8080)
Keycloak:
created realm
...
0
votes
1
answer
405
views
springboot oauth2 client azure active directory b2c issuer-uri problem
i set up spring boot with oauth2 client and here is my properties:
spring:
security:
oauth2:
client:
registration:
azuread:
authorization-grant-type: ...