Why does this spring oauth configuration never return 401 unauthorized?

Question

I followed the tutorial here to attempt to get started with spring Oauth. However, no pages return 401 unauthorized, even though I have not authenticated with the server (the configuration examples in the tutorial supposedly disable anonymous access. The only comment on the tutorial related to this issue has a single response saying the authorization has not been enabled, but I have @EnableAuthorizationServer on one of the configuration classes.

all config classes

Application:

@SpringBootApplication
@EnableTransactionManagement
@EnableAutoConfiguration(exclude = {RepositoryRestMvcAutoConfiguration.class})
public class Application extends SpringBootServletInitializer {
    @Override
    protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
        return application.sources(Application.class);
    }

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

Authorization Server:

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
    private static String REALM = "EXAMPLE_REALM";

    @Autowired
    private TokenStore tokenStore;

    @Autowired
    private UserApprovalHandler handler;

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authManager;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        clients.inMemory()
               .withClient("trusted-client")
               .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
               .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
               .scopes("read", "write", "trust")
               .secret("secret")
               .accessTokenValiditySeconds(300)//invalid after 5 minutes.
               .refreshTokenValiditySeconds(600);//refresh after 10 minutes.
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore).userApprovalHandler(handler)
                 .authenticationManager(authManager);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.realm(REALM + "/client");
    }
}

Resource Server (note that I changed the antMatchers to anyRequest for testing purposes):

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    private static final String RESOURCE_ID = "SPRING_REST_API";

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId(RESOURCE_ID).stateless(false);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.anonymous().disable()
            .requestMatchers().anyRequest()
            .and().authorizeRequests()
            .anyRequest().access("hasRole('ADMIN')")
            .and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
    }
}

"Security":

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private ClientDetailsService clientService;

    @Autowired
    public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("javabycode").password("123456").roles("USER")
            .and()
            .withUser("admin").password("admin123").roles("ADMIN");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .anonymous().disable()
            .authorizeRequests()
            .antMatchers("/oauth/token").permitAll();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }


    @Bean
    public TokenStore tokenStore() {
        return new InMemoryTokenStore();
    }

    @Bean
    @Autowired
    public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
        TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
        handler.setTokenStore(tokenStore);
        handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientService));
        handler.setClientDetailsService(clientService);
        return handler;
    }

    @Bean
    @Autowired
    public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
        TokenApprovalStore store = new TokenApprovalStore();
        store.setTokenStore(tokenStore);
        return store;
    }
}

Probably Unrelated, but there is also:

@Configuration
@EnableWebMvc
@EnableWebSecurity
public class WebConfig extends WebMvcConfigurerAdapter {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**");
    }
}

After reading through the full source code of the tutorial, I added

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        return new OAuth2MethodSecurityExpressionHandler();
    }
}

Finally, the build.gradle for the project since I have often had issues with specific versions of dependencies when working with spring:

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath("org.springframework.boot:spring-boot-gradle-plugin:1.5.1.RELEASE")
        classpath('com.h2database:h2:1.4.193')
        classpath('org.hibernate:hibernate-core:5.0.12.Final')
        classpath('org.springframework.boot:spring-boot-starter-security:1.5.2.RELEASE')
    }
}

apply plugin: 'idea'
apply plugin: 'java'
apply plugin: 'org.springframework.boot'
apply plugin: 'war'
sourceCompatibility = 1.8
targetCompatibility = 1.8

String appVersion = "1.0.0"

war{
    baseName="cubscout-rest"
    version=appVersion
    doFirst {
        manifest {
            attributes("Implementation-Title": 'cubscout-rest', "Implementation-Version": appVersion, "Implementation-Timestamp": new Date())
        }
    }
}

repositories {
    jcenter()
}

dependencies {
    compile project(':core')

    compile 'org.springframework.boot:spring-boot-gradle-plugin:1.3.5.RELEASE'
    compile 'org.springframework.boot:spring-boot-starter-web:1.5.1.RELEASE'
    compile 'org.springframework.boot:spring-boot-starter-data-jpa:1.5.1.RELEASE'
    //compile 'org.springframework.integration:spring-integration-core:4.3.7.RELEASE'
    //compile 'org.springframework.batch:spring-batch-core:3.0.7.RELEASE'
    compile 'org.springframework.data:spring-data-jpa:1.11.0.RELEASE'
    compile 'org.springframework.data:spring-data-rest-webmvc:2.6.0.RELEASE'
    compile 'org.springframework.security:spring-security-web:4.2.1.RELEASE'
    //compile 'org.springframework.boot:spring-boot-starter-security:1.5.2.RELEASE'
    compile 'org.springframework.security.oauth:spring-security-oauth2:2.1.0.RELEASE'
    compile 'org.hibernate:hibernate-core:5.0.12.Final'
    compile 'com.h2database:h2:1.4.193'
    compile 'org.springframework.boot:spring-boot-starter-tomcat:1.5.1.RELEASE'
    testCompile 'junit:junit:4.12'
    testCompile 'org.mockito:mockito-all:1.10.19'
    providedRuntime 'org.springframework.boot:spring-boot-starter-tomcat:1.5.1.RELEASE'
}

Trevor Giddings Trevor Giddings · Accepted Answer · 2017-04-11T02:17:06

One of Spring Boot's autoconfigurations was interfering. changing

@SpringBootApplication
@EnableTransactionManagement
@EnableAutoConfiguration(exclude = {RepositoryRestMvcAutoConfiguration.class})
public class Application extends SpringBootServletInitializer {

with

@SpringBootApplication
@EnableTransactionManagement
@EnableAutoConfiguration(exclude = {RepositoryRestMvcAutoConfiguration.class, OAuth2AutoConfiguration.class})
public class Application extends SpringBootServletInitializer {

allows my configurations to function properly.

Why does this spring oauth configuration never return 401 unauthorized?

1 Answers