Authorization code grant - rest

Question

I'm working on a REST API, that listens on localhost and I want to include Spring Security. Password grant and client credentials grant works perfectly and I can go check secured data from /smarthouse and /smarthouse2.
Although, when I try to use authorization code grant through postman, it gives me the same error and I have checked everywhere. My project is here: https://github.com/sharjak/Smarthouse. The action all happens in the demoapplication folder.
Authorization code in Postman
My code for authorization and resource server:
#Configuration
public class OAuth2ServerConfig {
#Configuration
#EnableResourceServer
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
#Override
public void configure(HttpSecurity http) throws Exception {
http
.anonymous().disable()
.csrf().disable()
.authorizeRequests()
.anyRequest()
.authenticated().and()
.formLogin();
}
}
#Configuration
#EnableAuthorizationServer
protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
#Autowired
private TokenStore tokenStore;
#Autowired
private AuthenticationManager authenticationManager;
#Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory().withClient("my-trusted-client")
.authorizedGrantTypes("password","authorization_code","refresh_token", "implicit")
.authorities("ROLE_CLIENT","ROLE_TRUSTED_CLIENT","ROLE_USER")
.scopes("read", "write", "trust")
.resourceIds("oauth2-resource")
.secret("secret")
.accessTokenValiditySeconds(6000)
.and()
.withClient("my-client")
.authorizedGrantTypes("authorization_code", "implicit")
.authorities("ROLE_CLIENT", "ROLE_USER")
.scopes("read","trust", "write")
.resourceIds("oauth2-resource")
.accessTokenValiditySeconds(6000)
.and()
.withClient("my-client-with-secret")
.authorizedGrantTypes("client_credentials","password")
.authorities("ROLE_CLIENT", "ROLE_USER")
.scopes("read", "trust", "write")
.resourceIds("oauth2-resource")
.secret("secret")
.accessTokenValiditySeconds(6000);
}
#Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
#Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints
.authenticationManager(authenticationManager)
.tokenStore(tokenStore);
}
#Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
oauthServer.checkTokenAccess("permitAll()");
}
}
}
Code for Websecurity server:
#Configuration
#EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
private ClientDetailsService clientDetailsService;
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.anonymous().disable()
.csrf().disable()
.authorizeRequests()
.antMatchers("/smarthouse", "smarthouse2", "/user").permitAll()
.and()
.formLogin();
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.withUser("admin").password("password").roles("ADMIN")
.and()
.withUser("sander").password("Sander123").roles("USER");
}
#Override
#Bean
public AuthenticationManager authenticationManagerBean() throws Exception{
return super.authenticationManagerBean();
}
#Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
#Bean
#Autowired
public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
handler.setTokenStore(tokenStore);
handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
handler.setClientDetailsService(clientDetailsService);
return handler;
}
#Bean
#Autowired
public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
TokenApprovalStore store = new TokenApprovalStore();
store.setTokenStore(tokenStore);
return store;
}
}
Stacktrace when I try to log in with a user:
org.springframework.security.authentication.InsufficientAuthenticationException: User must be authenticated with Spring Security before authorization can be completed.
at org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(AuthorizationEndpoint.java:138)
I'm quite a beginner, but it seems like a small problem to fix. Can anyone help me?

Answer 1

You just have to change your configure method from WebSecurityConfig to what follows:
http
.authorizeRequests()
.antMatchers("/login", "/favicon.ico",
"/oauth/confirm_access", "/oauth/token", "/smarthouse",
"smarthouse2", "/user").permitAll()
.anyRequest().authenticated().and()
.csrf().disable();
Why do you want to disable anonymous access?
Another point is that the order the matchers are declared matters.
I have cloned your repo and doing it worked for me.