Spring Oauth2. Password encoder is not set in DaoAuthenticationProvider

gajos :

I'm quite new to Spring Oauth and Spring Security. I'm trying to use the client_credentials flow in my project. For now i managed to user my own CustomDetailsService in order to fetch client_id and password (secret) from a database that already exists in my system. The only problem is that I cannot change the password encoder in DaoAuthenticationProvider that is used by AuthorizationServer - it is set by default to PlaintextPasswordEncoder. I wasn't able to configure it the way, that it would use for example SHAPasswordEncoder. It always uses the plaintext encoder. I probably don't understand the flow well enough, as I am a newbie in Spring.

Here's some code of mine (with not working configuration of DaoAuthenticationProvider):

SecurityConfig.java

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

private static final String RESOURCE_ID = "restservice";

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/register/**");

}

@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(daoAuthenticationProvider());
}

@Bean
public DaoAuthenticationProvider daoAuthenticationProvider() {
    DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
    daoAuthenticationProvider.setUserDetailsService(userDetailsService());
    daoAuthenticationProvider.setPasswordEncoder(passwordEncoder());
    return daoAuthenticationProvider;
}

@Bean
public PasswordEncoder passwordEncoder() {
    return new ShaPasswordEncoder();
}

@Configuration
@EnableAuthorizationServer
protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private MyCustomClientDetailsService myCustomClientDetailsService;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints)
            throws Exception {
        endpoints.tokenStore(tokenStore());
    }

    @Bean
    public ResourceServerTokenServices defaultTokenServices() {
        final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
        defaultTokenServices.setSupportRefreshToken(true);
        defaultTokenServices.setTokenStore(tokenStore());
        return defaultTokenServices;
    }

    @Bean
    public TokenStore tokenStore() {
        return new InMemoryTokenStore();
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.withClientDetails(myCustomClientDetailsService);
    }

    @Bean
    public MyCustomClientDetailsService detailsService() {
        return new MyCustomClientDetailsService();
    }
}

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    ...
}
}

And the custom ClientDetailsService class:

public class MyCustomClientDetailsService implements ClientDetailsService {

@Autowired
private UserService userService;

@Override
public ClientDetails loadClientByClientId(String clientId) throws ClientRegistrationException {

    User fan = userService.getFan(clientId);

    if (fan == null) {
        throw new NoSuchClientException("No client with requested id: " + clientId);
    } 

    BaseClientDetails details = new BaseClientDetails(clientId, restservice, "write", "client_credentials", "USER");

    details.setClientSecret(fan.getEncodedPassword()); 

    return details;
}
}

The encodedPassword that is taken from my UserService is always a bad Credential, as DaoAuthenticationProvider has a PlaintextPasswordEncoder set by default.

What am i missing there? Is it possible to set the password encoder in the DaoAuthenticationProvider that is used for checking the credentials here? Or do I have to write my own AuthenticationProvider, that would check it the way i want?

Leon :

The solution I found to the problem is to override configure on AuthorizationServerConfigurerAdapter

@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
    oauthServer.passwordEncoder(passwordEncoder);
}

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

Password Encoder/Decoder in Spring Boot

oAuth2 client with password grant in Spring Security

Spring OAuth2 ClientId passed in as username for password grant type

Spring Security 5 OAuth2 client password grant type

Spring security Oauth2 Resource Owner Password Credentials Grant

Spring OAuth2 asking for password when sending refresh token

Set cookies on successful OAuth2 Authentication in Spring Security OAuth2 implementation

Is there a way to configure password encoder for default spring security password

why spring security gives empty password to password encoder?

Fetching user name & password to Verify in Grant type "password" using Spring security OAUTH2

Spring Security with OAuth2 and JWT: Encoded password does not look like BCrypt

How to configure oAuth2 with password flow with Swagger ui in spring boot rest application

Spring OAuth2 server cannot refresh token with Resource owner credentials (password) grant flow

How do I handle CORS in Spring Boot Oauth2 Resource Server with password grant

Spring OAuth2 Password Flow , Return JWT inside HTTP Only Cookie?

How to set proxy on spring oauth2 OAuth2AccessToken request or How to override OAuth2AccessTokenSupport restTemplate variable?

Spring Security: DaoAuthenticationProvider autoconfiguration with default PasswordEncoder and UserDetailsService

How to load a custom DaoAuthenticationProvider into the Spring Context?

Spring security - Cannot find class DaoAuthenticationProvider

Springboot with Spring OAuth2

JWT with Spring OAuth2

Spring OAuth2: InsufficientAuthenticationException

Spring Boot Rest Security Basic Auth Password Encoder does not encrypt password on login

Thunderbird: Use of master password with OAuth2

Oauth2 access to API by email/password

Spring Security Oauth2 for Spring Website

Spring OAuth2 - custom "OAuth Approval" page at oauth/authorize

OAuth2 (Okta): How to set authorization

Spring Boot OAuth2 not redirecting to facebook