CODEWITHSUNDEEP
springspring-securityspring-security-oauth2
Kakawait
Kakawait

Reputation: 4029

Spring OAuth2 determine if principal is oauth2_client or basic user

I have an ResourceServer app (@EnableResourceServer) connected to an AuthorizationServer (@EnableAuthorizationServer).

I want to support two grant types:

  1. Authorization code
  2. Client credentials

Both are working correctly, but how can I differentiate if Principal is basic user (using authorization code flow) or client (using client credentials)?

If is not directly possible do you think I should create a specific role/authority or scope (which is better?) to determine when Principal is a client?

Upvotes: 2

Views: 805

Answers (1)

Jim.R
Jim.R

Reputation: 743

Once you've authenticated, you should have an instance of org.springframework.security.oauth2.provider.OAuth2Authentication set in the SecurityContext which contains details of both the authenticated user and the client they are using.

This has an isClientOnly() method which will return true if the client credentials grant is used. You can also check this in the @PreAuthorize tags if you've enables the OAuth2 expressions:

@PreAuthorize("#oauth2.isClient")

Upvotes: 1

Related Questions