Generating OAuth Tokens Part 1
We will talk about how to generate OAuth tokens. When using OAuth tokens, passwords are not shared between services. Instead, tokens are used for authentication. Here, we will create a basic authorization server that creates tokens given the username and password.
Let us create a new class that extends AuthorizationServerConfigurerAdapter. We can annotate it with @Configuration to tell it is a configuration class and has one or more @Bean methods. To enable the authorization server, we will use @EnableAuthorizationServer.
xxxxxxxxxx
public class AuthServer extends AuthorizationServerConfigurerAdapter
Now, let us create a bean for the password encoder. We can use the BcryptPasswordEncoder for encoding the passwords.
xxxxxxxxxx
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
We will override the configure methods as below. There are three configure methods. We will do it as below. Here, we can configure grant types, passwords, refresh token validity, access token validity, scopes
xxxxxxxxxx
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory().withClient("client")
.secret(passwordEncoder.encode(("secret")))
.authorizedGrantTypes("password")
.scopes("webclient","mobileclient");
}
Grant Types:
- Authorization code grant.
- Implicit grant.
- Resource owner credentials grant.
- Client credentials grant.
- Refresh token grant.
Scope
Scopes limits the application's access to user's accounts. It can have one or more scopes.
xxxxxxxxxx
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.authenticationManager(authenticationManagerBean);
}
Let us now create on more class WebSecurity, which extends WebSecurityConfigurerAdapter and annotate it with @Configuration and @EnableWebSecurity
xxxxxxxxxx
public class WebSecurity extends WebSecurityConfigurerAdapter
Let us override the configure method
xxxxxxxxxx
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("user").password(passwordEncoder.encode("user")).roles("USER");
}
Here, I am having username as "user" and password as "user", and roles I've specified as "USER".
Now, let me create a bean. This is required in the newer versions.
xxxxxxxxxx
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
Now, a very minimal authorization server is ready. Please see the classes below:
AuthServer.java
xxxxxxxxxx
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.PasswordEncoder;
public class WebSecurity extends WebSecurityConfigurerAdapter {
private PasswordEncoder passwordEncoder;
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("user").password(passwordEncoder.encode("user")).roles("USER");
}
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
}
WebSecurity.java
xxxxxxxxxx
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.PasswordEncoder;
public class WebSecurity extends WebSecurityConfigurerAdapter {
private PasswordEncoder passwordEncoder;
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("user").password(passwordEncoder.encode("user")).roles("USER");
}
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
}
Please find the source code at https://github.com/gudpick/oauth-demo/tree/oauth-starter
Please find video tutorials at:
Opinions expressed by DZone contributors are their own.