Spring Security 5.2 Password Flow

spc16670 :

I am trying to authenticate the user using the password flow in the latest version of Spring Security - 5.2.

The docs seem to suggest how to do that.

@Bean
public OAuth2AuthorizedClientManager passwordFlowAuthorizedClientManager(
        HttpClient httpClient,
        ClientRegistrationRepository clientRegistrationRepository,
        OAuth2AuthorizedClientRepository authorizedClientRepository) {

    HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
    requestFactory.setHttpClient(httpClient);

    DefaultPasswordTokenResponseClient c = new DefaultPasswordTokenResponseClient();
    RestTemplate client = new RestTemplate(requestFactory);
    client.setMessageConverters(Arrays.asList(
            new FormHttpMessageConverter(),
            new OAuth2AccessTokenResponseHttpMessageConverter()));
    client.setErrorHandler(new OAuth2ErrorResponseErrorHandler());
    c.setRestOperations(client);

    OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
                .password(configurer -> configurer.accessTokenResponseClient(c))
                .refreshToken()
                .build();

    DefaultOAuth2AuthorizedClientManager authorizedClientManager =
            new DefaultOAuth2AuthorizedClientManager(
                    clientRegistrationRepository, authorizedClientRepository);
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

    authorizedClientManager.setContextAttributesMapper(authorizeRequest -> {
        Map<String, Object> contextAttributes = new HashMap<>();
        String username = authorizeRequest.getAttribute(OAuth2ParameterNames.USERNAME);
        String password = authorizeRequest.getAttribute(OAuth2ParameterNames.PASSWORD);
        contextAttributes.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
        contextAttributes.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
        return contextAttributes;
    });

    return authorizedClientManager;
}



I execute the request, I can see the access token returned in HTTP header but the SecurityContext is not populated and the session user remains anonymous.

String username = "joe";
String password = "joe";
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
ClientRegistration r = clientRegistrationRepository.findByRegistrationId("keycloak");

OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId(r.getRegistrationId())
        .principal(authentication)
        .attributes(attrs -> {
            attrs.put(OAuth2ParameterNames.USERNAME, username);
            attrs.put(OAuth2ParameterNames.PASSWORD, password);
        })
        .build();
OAuth2AuthorizedClient authorizedClient = this.authorizedClientManager.authorize(authorizeRequest);

Any ideas?

spc16670 :

After reading into the documentation a bit more I do not think that Oauth 2 password flow in Spring Security 5.2 is supported the same way authorisation flow is. Spring Security 5.2 has password flow support for the http client which can cache the authorization request and refresh the token before it expires - but there is no end user password flow support in which the client proxies the credentials to the authorization server.

Of course, it is entirely possible to authenticate the end user by harvesting the credentials, implementing a custom AuthenticationProvider that swaps the credentials for a token with the authorization server and returns an OAuth2AuthenticationToken that is persisted to the context.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

Spring Security 5 OAuth2 client password grant type

Spring security oauth 2 and client credentials flow

Spring Boot 2, Spring Security 5 and @WithMockUser

Spring Security Oauth2 Resource Owner Password flow: When I send a REST request, my user detail service always gets the client id instead of username

Spring Security : Encrypt password

oAuth2 client with password grant in Spring Security

Spring security Oauth2 Resource Owner Password Credentials Grant

Spring Web Flow 2.4.1 and Spring Security 4.0.1

Spring security_Password Encryption

Username Password Authentication in Spring Security

Spring security: get password in UserDetailsServiceMethod

Recover username and password with spring security

Password is not getting encoded in spring security

Migrating from Spring Boot Oauth2 to Spring Security 5

Multi-Factor Authentication with Spring Boot 2 and Spring Security 5

Fetching user name & password to Verify in Grant type "password" using Spring security OAUTH2

How to configure oAuth2 with password flow with Swagger ui in spring boot rest application

Spring OAuth2 server cannot refresh token with Resource owner credentials (password) grant flow

Spring OAuth2 Password Flow , Return JWT inside HTTP Only Cookie?

Java Spring Security 5 + MySQL Database: Encoded password does not look like BCrypt

How to secure Vaadin flow application with Spring Security

How to setup Spring Cloud Data Flow security

Does Spring Security OAuth2 support Authorization Code Flow with PKCE for browser (Angular) clients?

Spring 5 Security OAuth2 Login Redirect Loop

Is the $2y$ bcrypt hash version supported by Spring 5 Security?

Spring Security 5 Replacement for OAuth2RestTemplate

Spring Security 5 rest client with OAuth2

Spring security 5: providing roles for OAuth2 authenticated users

Null @AuthenticationPrincipal and PreAuthorized not working Spring Boot 2 / Security 5