Spring Security login problem after migration Spring Boot version 1.5 to version 2.2: HTTP Error code 302

146 Views Asked by At

I'm migrating from Spring Boot 1.5 to Spring Boot 2.2.4 . I would like to keep for the moment the authentication that was implemented in version 1.5 . I have problems with authentication, when I log in the oauth/token responds with status 302

enter image description here

When I was in version 1.5 the authentication worked now it returns the value 302. The dependencies used

  • spring-security-oauth2 2.2.4.RELEASE
  • spring-security-jwt 1.0.8.RELEASE
@Configuration
@EnableWebSecurity
@Order(1)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    @Qualifier("customUserDetailsService")
    private UserDetailsService userDetailsService;
    
    @Autowired
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
        auth.authenticationProvider(authenticationProvider());
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        
        // @formatter:off
        http
            .csrf().disable()
                    .anonymous().and()
                    .authorizeRequests()
                        .antMatchers("/test/echo").permitAll()
                        .antMatchers("/health").permitAll()
                        .antMatchers("/info").permitAll()
                        .antMatchers("/mappings").permitAll()
                        .antMatchers("/login.html").permitAll()
                        .antMatchers("/oauth/token/revokeById/**").permitAll()
                        .antMatchers("/tokens/**").permitAll()
            .anyRequest().authenticated()
            .and().formLogin().successHandler(new AppAuthenticationSuccessHandler());
        // @formatter:on
    }
    
    @Override
    public void configure(WebSecurity webSecurity) throws Exception {
        webSecurity.ignoring().antMatchers("/passwordLost/**");
        webSecurity.ignoring().antMatchers("/user/email/**");
        //This is necessary to load swagger resources
        //webSecurity.ignoring().antMatchers("/v2/api-docs", "/swagger-resources/**","/swagger-ui.html", "/configuration/**", "/webjars/**");
    }
    
    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        authenticationProvider.setUserDetailsService(userDetailsService);
        authenticationProvider.setPasswordEncoder(passwordEncoder());
        return authenticationProvider;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

}
@Configuration
@EnableAuthorizationServer
public class OAuth2AuthorizationServerConfigJwt extends AuthorizationServerConfigurerAdapter implements InitializingBean {

    @Value(value = "${oauth2.access_token.validity_seconds}")
    private int accessTokenValiditySeconds;

    @Value(value = "${oauth2.refresh_token.validity_seconds}")
    private int refreshTokenValiditySeconds;

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Autowired
    @Qualifier("customUserDetailsService")
    private UserDetailsService userDetailsService;
    
    @Override
    public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.tokenKeyAccess("permitAll()")
            .checkTokenAccess("isAuthenticated()");
    }

    @Override
    public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
            .withClient("ClientId")
            .secret(xxxx)
            .authorizedGrantTypes("password", "authorization_code", "refresh_token")
            .scopes("xxx", "xxx", "xxx")
            .accessTokenValiditySeconds(accessTokenValiditySeconds) 
            .refreshTokenValiditySeconds(refreshTokenValiditySeconds); 
    }

    @Bean
    @Primary
    public DefaultTokenServices tokenServices() {
        final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
        defaultTokenServices.setTokenStore(tokenStore());
        defaultTokenServices.setSupportRefreshToken(true);
        return defaultTokenServices;
    }

    @Override
    public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        final TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
        tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer(), accessTokenConverter()));
        endpoints.tokenStore(tokenStore())
            .tokenEnhancer(tokenEnhancerChain)
            .authenticationManager(authenticationManager)
            .userDetailsService(userDetailsService);
    }

    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(accessTokenConverter());
    }

    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        final JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        final KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(new ClassPathResource("xxxx.jks"), "xxxx".toCharArray());
        converter.setKeyPair(keyStoreKeyFactory.getKeyPair("xxxx"));
        return converter;
    }

    @Bean
    public TokenEnhancer tokenEnhancer() {
        return new CustomTokenEnhancer();
    }

    @Override
    public void afterPropertiesSet() throws Exception {
        System.out.println("");
    }
}
0

There are 0 best solutions below