Quantcast
Channel: Active questions tagged rest - Stack Overflow
Viewing all articles
Browse latest Browse all 3655

How to use Spring OAuth2 JWT Token?

$
0
0

We want use the Spring OAuth2 JWT Token support. Our architecture is as follows: Spring just provides a REST-interface and the frontend is built with AngularJS which queries the Spring-REST-Interface. For authorization purpose our frontend-team wants to use JWT. So I have taken a look on the Spring OAuth2 JWT support and still do not really know how to talk with the frontend about JWT-Tokens. After reading a little tutorial I have implemented this:

@Autowired@Qualifier("defaultAuthorizationServerTokenServices")private DefaultTokenServices tokenServices;public static void main(String[] args) {    SpringApplication.run(Application.class, args);     //TODO comments}@Configuration@EnableAuthorizationServerprotected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {    //@Autowired    private AuthenticationManager authManager;    @Bean    public JwtAccessTokenConverter accessTokenConverter() {        return new JwtAccessTokenConverter();    }    @Override    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {        oauthServer.tokenKeyAccess("isAnonymous() || hasAuthority('ROLE_TRUSTED_CLIENT')")                   .checkTokenAccess("hasAuthority('ROLE_TRUSTED_CLIENT')");     }    @Override    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {        endpoints.authenticationManager(authManager).accessTokenConverter(accessTokenConverter());    }    @Override    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {        clients.inMemory()        .withClient("my-trusted_client")            .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")            .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")            .scopes("read", "write", "trust")            .accessTokenValiditySeconds(60)        .and()        .withClient("my-client-with-registered-redirect")            .authorizedGrantTypes("authorization_code")            .authorities("ROLE_CLIENT")            .scopes("read", "trust")            .redirectUris("http://anywhere?key=value")        .and()        .withClient("my-client-with-secret")            .authorizedGrantTypes("client_credentials", "password")            .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")            .scopes("read", "write")            .secret("secret");    }}

I'm not sure how the workflow is. What I guess: The frontend access the /oauth/authorization endpoint to authorize its token and then the Spring backend has to check every time a resource is requested the JWT-Token if it's authorized to access the resource? Right? So how can I tell Spring to check the token when a REST-endpoint is requested? I have tried it with

@RequestMapping("/projects")@PreAuthorize("oauthClientHasRole('ROLE_CLIENT')")public String getProjects() {    return "";}

But it seems not to work.


Viewing all articles
Browse latest Browse all 3655

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>