Accessing REST API secured with Spring Boot 2 and OAuth 2 using Postman

Question

I am building a REST API server with Spring Boot 2 and Spring Security 5. I am using an OAuth2 based IDP which is running on a remote server I am able to configure the OAuth2 client to use the IDP and when I try to hit any url from a web browser it shows up with the Spring generated UI. https://imgur.com/3x98x5A.png

I am able to complete the auth flow and am able to access the secured resource from the web browser.

Now I try to do the same using Postman, where I generate the access token, and ask postman to use Request Headers to pass the token to my API server(Resource server), as shown below: https://imgur.com/z4OvUu4.png

However when I do the GET request to my API it returns back with the HTML of the spring generated login page :(

My spring boot application.properties file is as follows:

spring.security.oauth2.client.registration.wso2.client-id=<removed>
spring.security.oauth2.client.registration.wso2.client-secret=<removed>
spring.security.oauth2.client.registration.wso2.client-authentication-method=basic
spring.security.oauth2.client.registration.wso2.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.wso2.redirect-uri-template={baseUrl}/login/oauth2/code/{registrationId}
spring.security.oauth2.client.registration.wso2.scope = openid, profile
spring.security.oauth2.client.registration.wso2.client-name=WSO2 ID Provider

spring.security.oauth2.client.provider.wso2.authorization-uri=https://localidpserver:9443/oauth2/authorize
spring.security.oauth2.client.provider.wso2.token-uri=https://localidpserver:9443/oauth2/token
spring.security.oauth2.client.provider.wso2.user-info-uri=https://localidpserver:9443/oauth2/userinfo
spring.security.oauth2.client.provider.wso2.jwk-set-uri=https://localidpserver:9443/oauth2/jwks

My POM file is as follows:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.okta.developer</groupId>
    <artifactId>oidc</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>oidc</name>
    <description>Demo project for Spring Boot</description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.2.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webflux</artifactId>
        </dependency>
        <dependency>
           <groupId>org.springframework.security</groupId>
           <artifactId>spring-security-config</artifactId>
        </dependency>
        <dependency>
           <groupId>org.springframework.security</groupId>
           <artifactId>spring-security-oauth2-client</artifactId>
        </dependency>
        <dependency>
           <groupId>org.springframework.security</groupId>
           <artifactId>spring-security-oauth2-jose</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>io.projectreactor</groupId>
            <artifactId>reactor-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>


</project>

I would highly appreciate a response :)

Richard Sinelle Richard Sinelle · Accepted Answer · 2018-08-09T10:39:39

To be confirmed but Spring Security Oauth is not compatible with Webflux implementation with Spring Boot 2.0, due to spring security implementation based on Servlet framwework.

You need to move to 2.1.0.M1 and Spring security 5.1.0.M1, check

Accessing REST API secured with Spring Boot 2 and OAuth 2 using Postman

1 Answers