Questions tagged [spring-security-oauth2]
Spring Security's deprecated implementation of the OAuth2 spec. For OAuth2 with Spring Security 5 use Spring Security tag. We don't get many questions on OAuth 1(a) but feel free to tag them here.
3,086
questions
0
votes
0
answers
12
views
Spring OAuth2RestTemplate throwing error NoSuchMethodError: Jackson databind
I updated my spring version to 5.2.22.RELEASE and all the fasterxml.jackson packages to 2.13.3.
Now when I hit a OAuth2RestTemplate method is get the following error.
java.lang.NoSuchMethodError: com....
1
vote
2
answers
27
views
ServerHttpSecurity authorizeExchange PermitAll Not Working
I've configured auth0 authentication with spring cloud API gateway, My basic setup is as follows,
POST - /user/api/user/registration - PermitAll
All Other API endpoints are authenticated.
So used ...
0
votes
1
answer
42
views
Where is the documentation for removing Oauth from Spring Security? [closed]
I know OAuth is now supported by Spring Security, so I want to review the official documentation so that I know how to safely remove it from my project.
However, when I go to the official site page ...
0
votes
0
answers
23
views
Avoid Okta dependency on application properties
My application allows customers to perform OKTA SSO. Whenever a new customer signs in the contract, I have to add bunch of properties in application properties file and deploy the code again on the ...
0
votes
0
answers
23
views
How to send Credentials to Spring-Authorization-Server
I'm trying to make Authorization Server with Spring-Authorization-Server.
To generate Authorization Code, I need to authenticate the user.
But I don't know how to authenticate User(without FormLogin).
...
0
votes
0
answers
15
views
OAuth2AuthorizedClient is always null @ azure implementation
I am currently try to get the refreshtoken because at a certain time the token will be unvalid and I would like to refresh my accesstoken.
Problem is that OAuth2AuthorizedClient is always Null.
@...
0
votes
0
answers
34
views
Apigee as Authorization Server
I am trying to validate a JWT token from springboot generated by one of my custom apigee proxy. Wondering whether I can use spring security and use Apigee as authorization server to validate JWT?
Here ...
0
votes
1
answer
48
views
Caused by: java.lang.RuntimeException: com.nimbusds.oauth2.sdk.ParseException: Unexpected type of JSON object member with key "mtls_endpoint_aliases"
I'm running a spring-boot app which acts as a oauth2 resource server and all requests must have a valid jwt. But I'm getting the following error at the application startup.
Caused by: org....
-2
votes
0
answers
22
views
Rest endpoint access based on scenario
I am working on product where I want to restrict API access based on Subscription level.
I have created microservices in spring boot and spring cloud gateway as API Gateway with Keycloak as Identity ...
0
votes
1
answer
41
views
Azure AD B2C how to configure the "aud" claim
I am new to the Azure ecosystem and I am a bit lost.
I use Azure AD B2C to secure multiple Spring Boot applications but I have a strange behavior, it seems like a token is tied to a specific ...
-2
votes
0
answers
16
views
EnableAuthorizationServer is deprecated [duplicate]
In latest maven dependency of spring-security-oauth2-autoconfigure EnableAuthorizationServer is depricated. But still in old versions its not showing depricated message.
Our application needed more ...
-2
votes
1
answer
54
views
Oauth2 and OpenId Connect Implementation
We are trying to implement an application where UI is in angular and backend is in Spring boot.
We need to implement openId and oauth2 in our application.
Backend api's needs to be more secure.
I am ...
-2
votes
0
answers
18
views
Spring Security OAuth2 login failure even if using right credentials on the 2nd attempt
Hi I'm developing a login system where we only ask for the id of the user. So I decided to create the ff:
AuthenticationFilter
package com.sample.config.filter;
import lombok.extern.slf4j.Slf4j;
...
0
votes
1
answer
32
views
OAuth2 with Google and Spring Boot - I can't log out
I've been trying to get a successful Oauth2 login with Google and Spring Boot for a while now. This only works partially. Why partly - because I can't manage the logout or when I pressed the logout ...
0
votes
0
answers
32
views
Looking for Spring Security 5 OAuth2 Resource Server without Spring Boot examples, guides or resources
I have a Spring 5 MVC application without Spring Boot that I need to migrate it's current Spring Security LDAP implementatino to a new Spring Security OAuth2 Resource Server implementation. I tried ...
-1
votes
1
answer
30
views
silent renew doesn't work on spring-authorization-server and react client
I try to implement authorization flow with spring-authorization-server https://github.com/spring-projects/spring-authorization-server and react app, i use https://github.com/authts/react-oidc-context ...
0
votes
0
answers
72
views
Error creating bean with name 'securityFilterChain'
I am Learning Spring Boot and i am trying to apply OAuth2 to my rest API. but now I Am getting an error that i does not understand.I have looked up so many answers but it The Error is as :
org....
0
votes
0
answers
19
views
Common security module for all microservices
We have developed project using spring boot microservices. We have implemented spring security on each microservice. We are using wso2 IAM. Is it good practice to use security on each microservice or ...
1
vote
1
answer
22
views
Spring Boot oauth2 social login: Cannot login after session timeout
I use social login in a spring boot container. This works fine, but when I keep the browser open over night, the next morning I cannot login any more. I need to restart the container and refresh the ...
0
votes
0
answers
28
views
Springboot webflux throwing 401 when Authorization header sent to unrestricted endpoint
How to exclude JwtTimestampValidator from the spring security filter.
JwtTimestampValidator is getting executed when we pass a JWT token to an open or unrestricted endpoint.
http.authorizeExchange()
....
0
votes
1
answer
89
views
How do I get the Access Token via the OAuth2AuthorizedClientService in the Client Credentials Flow?
I have created a client with Spring Security. As Authorization Server I use Keycloak.
Now I want to gain access to the access token, using the parameter annotation @RegisteredOAuth2AuthorizedClient(...
0
votes
0
answers
59
views
Spring WebClient slow when retrieving Oauth2 token
I'm trying to consume an API that requires OAuth2 authorization. For this, I tried configuring Spring reactive WebClient as follows:
@Configuration
@Slf4j
public class MyConfiguration {
@Bean(&...
0
votes
0
answers
52
views
Spring Security with oauth2 local environment configuration setting mocking principal
we are using version 2.6.3 of spring-security-oauth2-autoconfigure
This is our Security Configuration
@EnableWebFluxSecurity
public class SecurityConfiguration {
@Profile({"!inhibit-security"...
0
votes
0
answers
33
views
Token verification once user logged out from app
As I understood correctly, from few resources like RemoteJWT Cache TTL,
Spring cached the JWK set in Resource Server for minimising the remote call to Authorisation Server for token verification to ...
0
votes
1
answer
41
views
How can I require consent for each unique anonymous user with Spring Security OAuth2?
My app has a singular endpoint. It triggers an OAuth2 authorization grant flow. It is meant to be called only by anonymous users. Each anonymous user represents a different person with different ...
0
votes
0
answers
27
views
Issue in migrating OAuth2 SSO provider of Spring boot application from one provider to another
I am working with migrating OAuth2 SSO provider for my Spring boot application from SSOProvider1 to SSOProvider2.
My application has been working fine with SSOProvider1. The relevant properties are as ...
0
votes
1
answer
51
views
OAuth2 GrantedAuthorities not present in JWT when using custom UserDetailsService
Using the new spring-authorization-server 0.2.3 and following https://github.com/spring-projects/spring-authorization-server/tree/main/samples as reference I was able to setup an authorization server, ...
0
votes
0
answers
38
views
OidcClientInitiatedLogoutSuccessHandler not being called with non Spring Boot application
Configured the logoutSuccessHandler and it works fine with a Spring Boot application. But the request to logout is not being sent to the provider with a non Spring Boot application.
Using version 5.6....
2
votes
1
answer
73
views
Unable to make the oauth2Login as stateless
I have provided the cookie based authorization request repository to oauth2Login() dsl to make it as stateless. but when I add the session creation policy as STATELESS , the oauth2 login is not ...
0
votes
0
answers
60
views
Introspect call to Authorization server from Resource Server fails after second successive calls
Introspect is failing after 2 successive attempts.
Error : Introspect endpoint response was invalid,as content-type 'text/html' is not compatible with JSON at org.springframework.security.oauth.server....
0
votes
0
answers
11
views
SecurityContextHolder authentication object not available to subsequent requests from the client
Inside getUserObject() method we are not able to get Authentication object. It's available for 1st request only. But its setting to null for subsequent requests from client. So please help me to ...
0
votes
0
answers
29
views
WebSecurity.ignoring() in ResourceServerConfigurerAdapter
I'm currently implementing oauth2 through Cognito for my Spring Boot API. As a part of configuring Spring Security, I set up my ResourceServerConfigurerAdapter with an override of configure(...
0
votes
1
answer
81
views
Supporting concurrent full-stack MVC (session) authentication as well as stateless JWT authentication in Spring Authorization Server (0.2.3+)
When creating an Authorization server, I have a relatively simple AS. It supports:
User Registration (WebMVC)
FormLogin (WebMVC)
Forgot Password (WebMVC)
Managing RegisteredClient (WebMVC) - a place ...
0
votes
0
answers
25
views
Spring RSocket Accessing setup information
I am using Spring RSocket support and Spring Security RSocket. I setup the security configuration so that on each request/response interaction, the requester send bearer token which my code can access ...
0
votes
0
answers
92
views
Extracting Principal data using ReactiveSecurityContextHolder
I have a Spring webflux microservice, with working OAuth authentication in place.
I can access the Principal using the @AuthenticationPrincipal annotation in the controller method parameters:
@...
0
votes
1
answer
180
views
Spring Session (Redis) + Oauth2 + Spring Cloud Gateway fails when restarting application if session already exists
Version
Spring Boot Version: 2.6.5
Spring Cloud Version: 2021.0.0
The application built has the following characteristics:
It is a reactive application (Reactor + WebFlux)
It is an Oauth2 Client ...
0
votes
1
answer
65
views
How to improve non-tenant UX in an Azure AD enterprise app with automatic SSO sign-in?
I have an Angular app that supports Azure AD authentication via a spring security backend. It supports anonymous (non-tenant) access but no other authentication methods.
On load, if there is no ...
0
votes
1
answer
39
views
Java - OAuth 2 using restTemplate to get login with refresh token (StackOverFlowError)
I created an interceptor to get the token before i do other request but i have the error "Method threw 'java.lang.StackOverflowError' exception." when i do the request.
public ...
0
votes
0
answers
54
views
Adding secured and unsecured paths on on API Gateway
I have set up routes on API gateway + Oauth2 resource server. Some of them are accessible to everyone and some of them are secured. While the rest of my paths work as expected the register-user path, ...
0
votes
1
answer
54
views
Adding a custom OidcUserService to work with Spring Azure AAD OidcUserService
We have the following Spring Security Configuration class that extends Spring Azure configuration adapter and want to add a custom OidcUserService to the userInfo callback. We have 2 separate projects,...
0
votes
2
answers
78
views
Spring Security+ReactJS - Preflight Request
I am working on a project with FE as react and BE as Springboot. I am trying to add FE to the application. After registration, I have tried to login to the application. After successful login, we get ...
0
votes
0
answers
69
views
Spring Cloud Gateway Getting a 500 Exception while trying to refresh_token using expired access_token and refresh_token
I have a secured Spring Cloud Gateway application using ServerHttpSecurity.oauth2Login() that can successfully renew expired access tokens using the refresh token. However, when the refresh token also ...
1
vote
1
answer
80
views
OAuth2Authentication object deserialization (RedisTokenStore)
I'm trying to rewrite some legacy code which used org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore to store the access tokens. I'm currently trying to use the ...
0
votes
1
answer
80
views
Apply dynamic ACL with spring security and JWT
I have implemented authentication using SpringSecurity, JWT and OAuth2.
@Override
public void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers(HttpMethod....
0
votes
1
answer
97
views
Pass user id as a header in downstream request. Spring Cloud Gateway + Oauth2 Resource Server
I want to implement security on my Spring cloud gateway server by making it an oAuth2 resource server. The requests are getting authenticated against my spring security authorization server. For some ...
0
votes
0
answers
13
views
OAuth2AuthenticationProcessingFilter called twice for an asynchronous endpoint causing problems
If partner calls our async endpoint one second before token validity ends, the first OAuth2AuthenticationProcessingFilter validates token in request as OK but while processing response one second ...
0
votes
1
answer
58
views
What should happen if a user sign up via social login and then tries to register with same mail?
In my Spring Boot I'd like to have both social login and signup with user and password.
Let's say the user signs-up via Google. After some time, he forgets that he signed-in via Google and tried to ...
0
votes
1
answer
77
views
Custom principle extractor from OAuth2 resource server
I'm trying to implement a custom principle extractor for my web application. I have a different application for the authentication and from that, I'm validating the token that im passing. For the ...
1
vote
1
answer
143
views
what is the best way to manage and store Oauth2 token in spring boot?
I have a spring boot application that communicates with an external rest API that uses Oauth2 and returns a token and refresh token valid for 90 days.
My question is what is the best way to manage ...
0
votes
0
answers
32
views
Spring reactive security with OAUTH2 not able to exclude end points(401 returned all times)
Am building the reactive rest APIs with reactive security implementation. But am unable to exclude some of the end points from OAUTH2 server(Health check end point). Even though am adding those in my ...