CODEWITHSUNDEEP
springspring-securityoauthspring-security-oauth2spring-cloud-gateway
Tom Sawer
Tom Sawer

Reputation: 182

Spring Cloud Gateway OAuth2 with Spring Security OAuth2 Authorization Server = loop

I'm trying to use Spring Authorization Server with Spring Cloud Gateway, but I'm stuck on getting user information. I can see in gateway logs messages like

[2020-03-23 13:36:35,061] TRACE org.springframework.web.HttpLogging - [45961b04] Decoded [{access_token=5b5a13f1-2b47-4739-bda2-74785f6e3828, token_type=bearer, expires_in=33556, scope=read}]

Which means authorization works fine, but after 302 FOUND Location: /res (protected resource) it forwards me back to authorization server.

Full code is in demo project here: https://github.com/looksworking/gw-oauth

Authorization Server:

build.gradle.kts

application.yml

WebSecurityConfig

AuthZServerConfig

Spring Cloud Gateway:

build.gradle.kts

application.yml

GatewayApplication

Any help is very appreciated.

Upvotes: 0

Views: 1324

Answers (1)

denizg
denizg

Reputation: 952

The gateway cannot get user info from authorization server to create principal. So, it redirects again to authorization server due to lack of principal. Try to create custom userinfo endpoint in authorization server. (/userinfo instead of /oauth/userinfo). You maybe need to permit /userinfo in security configuration.

@RestController
public class UserInfoEndpoint {

    @PostMapping("/userinfo")
    public Map<String, Object> user() {
        Map<String, Object> map = new HashMap<>();
        String name = SecurityContextHolder.getContext().getAuthentication().getName();
        map.put("user_name", name);
        return map;
    }

}

Also, add user-info-authentication-method: form to your provider.

Upvotes: 1

Related Questions