The OAuth2 Authorization Framework is simply a way to let third-party applications access your protected resources without you sharing your user credentials (username/password). You will have faced this situation when a website such as LinkedIn asks you to share your e-mail contacts, and when you agree, you are forwarded to your mail provider's login page (for example, Yahoo!).

When you log in, the mail provider asks for your permission to share your contacts with LinkedIn. Then, LinkedIn can get the list of your contacts in order to send them an invitation.

OAuth2 relies on the following entities:

Many leading providers (for example, Google and Facebook) have both authorization and resource servers.

This diagram illustrates how the OAuth2 framework works in a simple form:

Spring facilitates the OAuth2 framework by reusing Spring Security concepts for authentication and authorization and includes new features to implement authorization and resource servers. To use Spring OAuth2 in your project, you need the following dependency:

<dependency>
   <groupId>org.springframework.security.oauth</groupId>
   <artifactId>spring-security-oauth2</artifactId>
   <version>2.0.8.RELEASE</version>
</dependency>

What we explained in the Authentication section with respect to validating the user and protecting resources remains the same here. The new things are the authorization and resource server settings.

The OAuth 2.0 service includes authorization and resource servers. Spring Security lets you have separate applications as authorization and resource servers, on which one authorization server could be shared by one or many resource servers, or have both types of servers in a single application. For simplicity, we implement authorization and resource servers within the same application.

In the class MultiOAuth2ResourceAndAuthorizationConfigurator, we define resource and authorization servers. @EnableResourceServer tags the class ResourceServerConfiguration as a resource server, which defines resources with the URL /public as non-protected and ones with the /protected/** URL as secure resources that require a valid token to access.

@EnableAuthorizationServer tags AuthorizationServerConfiguration as an authorization server that grants tokens to third-party clients. TokenStore is a Spring interface; its implementation classes (InMemoryTokenStore, JdbcTokenStore, and JwtTokenStore) keep track of tokens.

JdbcTokenStore uses a database to store tokens and has a Spring-JDBC dependency. JdbcTokenStore is suitable when you want to have a history of tokens, recovery after server failure, or the sharing of tokens among several servers.

JwtTokenStore encodes token-related data into the token itself. JwtTokenStore does not make tokens persistent and requires JwtAccessTokenConverter as a translator between a JWT-encoded token and OAuth authentication information.

For simplicity, we use the InMemoryTokenStore implementation class, but in real applications, using JdbcTokenStore/JwtTokenStore is a better practice.

We reuse the AuthenticationManager class that was detailed in the Authentication section.

The method configure(ClientDetailsServiceConfigurer clients) is the location in which we configure token generation settings, as follows:

The settings are mentioned in the following code:

@Configuration
public class MultiOAuth2ResourceAndAuthorizationConfigurator {
    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
        @Override
        public void configure(HttpSecurity http) throws Exception {
            http
                .headers()
                .frameOptions().disable()
                .authorizeRequests()
                .antMatchers("/public/").permitAll()
                .antMatchers("/protected/**").authenticated();
        }
    }
    @Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter implements EnvironmentAware {
        private static final String  CLIENT_ID = "myClientId";
        private static final String  CLIENT_PASSWORD = "myClientPassword";
        private static final int  TOKEN_TIME_TO_LIVE = 1800;
        private static final String  ROLE_USER = "ROLE_USER";
        private static final String  ROLE_ACCOUNTANT = "ROLE_ACCOUNTANT";
        private static final String  READ_ACCESS = "read";
        private static final String  WRITE_ACCESS = "write";
        private static final String  GRANT_TYPE_PASSWORD = "password";
        private static final String  GRANT_TYPE_REFRESH_TOKEN = "refresh_token";
        @Bean
        public TokenStore tokenStore() {
            return new InMemoryTokenStore();
        }
        @Autowired
        private AuthenticationManager authenticationManager;
        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints
                .tokenStore(tokenStore())
                .authenticationManager(authenticationManager);
        }
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients
                .inMemory()
                .withClient(CLIENT_ID)
                .secret(CLIENT_PASSWORD)
                .scopes(READ_ACCESS, WRITE_ACCESS)
                .authorities(ROLE_USER, ROLE_ACCOUNTANT)
                .authorizedGrantTypes(GRANT_TYPE_PASSWORD, GRANT_TYPE_REFRESH_TOKEN)
                .accessTokenValiditySeconds( TOKEN_TIME_TO_LIVE);
        }
        @Override
        public void setEnvironment(Environment environment) {
        }
    }
}

The resources we granted access to using the token are included in a controller. Here, we define a very simple resource:


@RequestMapping(value = "/protected", method = RequestMethod.GET)
@ResponseBody
public String getProtectedResources(ModelMap model) {
   return "this is from getProtectedResources";
}
@RequestMapping(value = "/public", method = RequestMethod.GET)
@ResponseBody
public String getPublicResources(ModelMap model) {
   return  "this is from getPublicResources";
}

You can run the project with the following command, which builds and runs the resource and authorization server:

mvn clean package spring-boot:run -Dserver.contextPath=/myapp -Dserver.port=9090

If you try the following, you can see the resource because this URL is unprotected:

curl -i http://localhost:9090/myapp/public

However, if you try the next command, you get a "non-authorized" error and you need a valid token to access this resource:

curl -i http://localhost:9090/myapp/protected

You need to get a token first to be able to access protected resources. Spring MVC exposes an endpoint, TokenEndpoint, in order to get the token with the /oauth/token URL by default. The following command gives you an authorization token:

curl -X POST -vu myClientId:myClientPassword  'http://localhost:9090/myapp/oauth/token?username=operator&password=password&grant_type=password'

Now, you can provide the token and access the secure resource:

curl -i -H "Authorization: Bearer [access_token]" http://localhost:9090/myapp/protected

Notice that we set a time to live for the token and we need to refresh the token if it expires. The following command renews the token by calling the /oauth/token endpoint and passing refresh_token as the grant_type parameter:

curl  -X POST  -vu  myClientId:myClientPassword  'http://localhost:9090/myapp/oauth/token?grant_type=refresh_token&refresh_token=[refresh_token]'