4

I am using Spring Security Oauth 2.0 password flow to get a bearer token. using "oauth/token" Endpoint. Subsequent request made to the server sends back SET-COOKIE for the JSESSION ID. When the UI sends back the JSESSIONID the server returns anonymous user instead of the signed in user.

For some reason the JSESSIONID is not associated with the AUTH token. The association of JSESSIONID and auth token was working with Spring boot 1.5 AND OAUTH:2.0.0.RELEASE but not after upgrading to spring boot 2.0.8 and oauth2:2.3.4RELEASE

REQUEST1
http://localhost:9090/oauth/token
{
    "access_token": "a06f4924-0bf0-4726-8932-eeb0afb3758f",
    "token_type": "bearer",
    "expires_in": 43199,
    "scope": "read write"
}

REQUEST 2  
http://localhost:9090/ signin/check

HEADERS
authorization Bearer a06f4924-0bf0-4726-8932-eeb0afb3758f

RESPONSE
HEADERS
Set-Cookie →JSESSIONID=42477E242D38FA91A6DA61F92DCF4234; Path=/artulous-dev-v2; HttpOnly

BODY
{
    "id": 37,
    "firstName": null,
    "lastName": null,
    "email": null,
    "displayName": "demo User",
    "userPic": "img/user.jpg",
    "userThumb": null,
    "sessionId": null,
    "orgId": 28,
    "orgDisplayName": "INTERNET",
    "roles": [
        {
            "name": "ROLE_USER",
            "id": 2
        }
    ],
    "activities": [
        "ROLE_USER",
        "ROLE_USER",
        "upload_images"
    ],
    "signedIn": true,
    "admin": false
}

REQUEST 3
http://localhost:9090/artulous-dev-v2/signin/check
SENDS THE JSESSION ID  COOKIE but not auth token.

BODY
{
    "id": null,
    "firstName": null,
    "lastName": null,
    "email": null,
    "displayName": null,
    "userPic": null,
    "userThumb": null,
    "sessionId": "42477E242D38FA91A6DA61F92DCF4234",
    "orgId": null,
    "orgDisplayName": null,
    "roles": [],
    "activities": [],
    "signedIn": false,
    "admin": false
}

ACTUAL RESULT anonymous user.  But expected signed in user.

Dependencies

Spring boot version 2.0.8.RELEASE
 compile ("org.springframework.boot:spring-boot-starter-log4j2")
    compile("org.springframework.boot:spring-boot-starter-data-jpa")
    compile("org.springframework.boot:spring-boot-starter-data-rest")
    compile("org.springframework.security.oauth:spring-security-oauth2:2.3.4.RELEASE")

AuthorizationServerConfig.java


@Configuration
@EnableAuthorizationServer
@Order(Ordered.LOWEST_PRECEDENCE - 100)
public class AuthorizationServerConfigurer extends
        AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    UserDetailsService userDetailsService;

    @Autowired
    PasswordEncoder passwordEncoder;


    private ClientAndUserDetailsService combinedService_;

     @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints)
            throws Exception {
        endpoints.authenticationManager(authenticationManager);

    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients)
            throws Exception {

        String encodedClientSecret = passwordEncoder.encode("mobilesecret"); // assume encoded value is $%*@DJ#

        ClientDetailsService csvc = new InMemoryClientDetailsServiceBuilder()
                .withClient("mobile")
                .secret(encodedClientSecret)
                .authorizedGrantTypes("password")

                .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
                .scopes("read", "write")
                // .resourceIds(RESOURCE_ID)
                .and()

                .withClient("mobileReader")
                .secret("mobileReaderSecret")
                .authorizedGrantTypes("password")
                .authorities("ROLE_CLIENT").scopes("read")
                // .resourceIds(RESOURCE_ID)
                .accessTokenValiditySeconds(3600)

                .and().build();



        combinedService_ = new ClientAndUserDetailsService(csvc, userDetailsService);
        clients.withClientDetails(combinedService_);
    }

}

REsourceServerConfig.java


@Configuration
@EnableResourceServer
public class ResourceSecurityConfigurer extends
        ResourceServerConfigurerAdapter {

    @Autowired
    SignOutHandler signOutHandler;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        // resources.resourceId(AuthorizationServerConfigurer.RESOURCE_ID);
    }

    @Value("${spring.application.name}")
    private String appName;

    @Override
    public void configure(HttpSecurity http) throws Exception {

        http.csrf().disable();

        http
                // session management
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                .sessionFixation().changeSessionId();

        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/img/**").permitAll()
                .antMatchers("/fonts/**").permitAll()
                .antMatchers("/api-docs/**").permitAll()
                .antMatchers("/v2/api-docs/**").permitAll()
                .antMatchers("/swagger/**").permitAll()
                .antMatchers("/springfox/**").permitAll()
                .antMatchers("/swagger-ui.html").permitAll()

                .antMatchers("/api/**").permitAll()
                .antMatchers("/api-repo/**").permitAll()
                .antMatchers("/service/**").permitAll()


                .antMatchers("/bower_components/**").permitAll()
                .antMatchers("/stylesheets/**").permitAll()
                .antMatchers("/album/**").permitAll()
                .antMatchers("/appbase/**").permitAll()

                .antMatchers("/studio/**").permitAll()

                .antMatchers("/" + appName + "/**").permitAll()
                .antMatchers("/playground/**").permitAll()
                .antMatchers("/partials/**").permitAll()
//                .antMatchers(HttpMethod.OPTIONS, "/oauth/token").permitAll()
                //              .antMatchers(HttpMethod.POST, "/oauth/token").permitAll()
                .antMatchers("/3pl/**").permitAll()
                .antMatchers("/robots.txt").permitAll()
                .antMatchers("/sitemap.xml").permitAll()

                .antMatchers("/index.html").permitAll()
                .antMatchers("/signup/**").permitAll()
                .antMatchers("/signup.html").permitAll()
                .antMatchers("/register.html").permitAll()
                .antMatchers("/signin/**").permitAll()
                .antMatchers("/login/**").permitAll()
                .antMatchers("/auth/**").permitAll()
                .antMatchers("/disconnect/facebook").permitAll()
                .antMatchers("/login/facebook").permitAll()
                .antMatchers("/connect/facebook").permitAll()
                .antMatchers("/**").denyAll()
                .and()
                .anonymous()
                .and()
                .logout().permitAll()
                .logoutUrl("/signout")
                .addLogoutHandler(signOutHandler)
                .deleteCookies("remember-me")

                .and()
                .authorizeRequests()
                .and()
                .rememberMe()


                .and().apply(new SpringSocialConfigurer());

    }
3
  • this used to work. What is this? Maybe you can post a sample project that shows what is not working and developers will be able to help you. Spend some more time crafting a question that someone can help out with. Commented Feb 18, 2019 at 17:00
  • Updated the question to add more info Commented Feb 18, 2019 at 22:29
  • Do you got any solution? Commented Mar 2, 2020 at 18:53

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.