CODEWITHSUNDEEP
javaspringspring-bootoauthauthorization
Saeid Babaei
Saeid Babaei

Reputation: 86

Spring Boot Resource Server Invalid Token

I'm trying to configure OAuth2 for a Spring project. I used jdbc authentification and my authorization server and resource server are two separate API. My issue is now with the microservices. I'm trying to use this shared authorization server to authenticate the microservices. I can get access_token from the token endpoint.

enter image description here

I can check the access_token from the check_token endpoint.

enter image description here

My resource server configuration:

@SpringBootApplication
@EnableCircuitBreaker
@EnableDiscoveryClient
@EnableResourceServer
public class ProductApiServiceApplication {

    public static void main(String[] args) {
        SpringApplication.run(ProductApiServiceApplication.class, args);
    }
    
}

And application.yml:

security:
  oauth2:
    client:  
      client-id: saba-product-api-service
      client-secret: secret123 
    resource:
      id: saba-product-api-service
      token-info-uri: http://localhost:9999/uaa/oauth/check_token

And REST controller:

    @GetMapping("/user/me")
    public Principal user(Principal principal) {
        return principal;
    }

When I call the /user/me endpoint I get invalid_token.

enter image description here

My Resource Server log:

enter image description here

And my Authorization Server log:

enter image description here

What is wrong with my code?

Update

The problem is because of this code:

enter image description here

Upvotes: 1

Views: 1131

Answers (2)

Davi Carrano
Davi Carrano

Reputation: 499

I had the same issue. In my case, I was using spring cloud oauth2, Hoxton.SR4 release and it was working. So, I change to Hoxton.SR6 and the issue was throwed. My Authoriation Server also was a Eureka's client, and the issue was origined cause this dependency. There was one dependência inside Eureka Client, named jackson-dataformat-xml, and because it the return of check_token endpoint was converted in xml instead json. When RemoteTokenServices called check_token, and the resulta was a xml, it culdn't decerialized in map<String,Object> the right way. If you had more than one aud, scope or authorities, it picked the last one. And the active propertie was trated as string. In my case I solved the issue excluding in Authorization Server the dependency mentioned from Eureka Client, like this:

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
    <exclusions>
        <exclusion>
            <groupId>com.fasterxml.jackson.dataformat</groupId>
            <artifactId>jackson-dataformat-xml</artifactId>
        </exclusion>
    </exclusions>
</dependency>

Upvotes: 1

Saeid Babaei
Saeid Babaei

Reputation: 86

Finally, I replaced

<dependency>
    <groupId>org.springframework.security.oauth</groupId>
    <artifactId>spring-security-oauth2</artifactId>
    <version>2.3.4.RELEASE</version>
</dependency>

with

<dependency>
    <groupId>org.springframework.security.oauth</groupId>
    <artifactId>spring-security-oauth2</artifactId>
    <version>2.5.0.RELEASE</version>
</dependency>

        // gh-838
        if (map.containsKey("active") && !"true".equals(String.valueOf(map.get("active")))) {
            logger.debug("check_token returned active attribute: " + map.get("active"));
            throw new InvalidTokenException(accessToken);
        }

Upvotes: 0

Related Questions