CODEWITHSUNDEEP
oauth-2.0spring-security-oauth2java-ee-7
Luc Feys
Luc Feys

Reputation: 127

Spring security OAuth redirect endpoint not found

I have added Spring Security to an existing JEE application to add OAuth to the application. The security configuration is set to protect the REST API, and that part seems to work fine. When the UI requests a protected URL, the response contains a redirect to 'oauth2/authorize/keycloak'.

But that's where the story ends, since the request to 'oauth2/authorize/keycloak' itself returns a 404.

I am pretty out of date with spring security (have used it the last time with Spring applications about 8 years ago) and I have no idea where I am supposed to find the implementation of the endpoint 'oauth2/authorize/keycloak' in order to figure out what is missing or wrong in my setup.

The relevant part of my dependency tree looks as follows:

[INFO] |  +- com.mycompany.auth:authentication-sso-configuration:jar:1.0.0-SNAPSHOT:compile
[INFO] |  |  +- org.reactivestreams:reactive-streams:jar:1.0.3:compile
[INFO] |  |  +- org.springframework.security:spring-security-oauth2-client:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  +- com.nimbusds:oauth2-oidc-sdk:jar:7.5:compile
[INFO] |  |  |  |  +- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
[INFO] |  |  |  |  +- com.nimbusds:content-type:jar:2.0:compile
[INFO] |  |  |  |  +- net.minidev:json-smart:jar:2.3:compile (version selected from constraint [1.3.1,2.3])
[INFO] |  |  |  |  |  \- net.minidev:accessors-smart:jar:1.2:compile
[INFO] |  |  |  |  |     \- org.ow2.asm:asm:jar:5.0.4:compile
[INFO] |  |  |  |  \- com.nimbusds:lang-tag:jar:1.4.4:compile
[INFO] |  |  |  +- org.springframework.security:spring-security-oauth2-core:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  \- org.springframework:spring-core:jar:5.2.6.RELEASE:compile
[INFO] |  |  |     \- org.springframework:spring-jcl:jar:5.2.6.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-oauth2-jose:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  \- com.nimbusds:nimbus-jose-jwt:jar:8.18.1:compile
[INFO] |  |  +- org.springframework.security:spring-security-oauth2-resource-server:jar:5.3.3.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-core:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  +- org.springframework:spring-aop:jar:5.2.6.RELEASE:compile
[INFO] |  |  |  +- org.springframework:spring-beans:jar:5.2.6.RELEASE:compile
[INFO] |  |  |  +- org.springframework:spring-context:jar:5.2.6.RELEASE:compile
[INFO] |  |  |  \- org.springframework:spring-expression:jar:5.2.6.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-web:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  \- org.springframework:spring-web:jar:5.2.6.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-config:jar:5.3.3.RELEASE:compile
[INFO] |  |  +- org.springframework.security:spring-security-saml2-service-provider:jar:5.3.3.RELEASE:compile
[INFO] |  |  |  +- org.opensaml:opensaml-core:jar:3.4.5:compile
[INFO] |  |  |  |  +- io.dropwizard.metrics:metrics-core:jar:3.1.2:compile
[INFO] |  |  |  |  \- net.shibboleth.utilities:java-support:jar:7.5.1:compile
[INFO] |  |  |  +- org.opensaml:opensaml-saml-api:jar:3.4.5:compile
[INFO] |  |  |  |  +- org.opensaml:opensaml-xmlsec-api:jar:3.4.5:compile
[INFO] |  |  |  |  |  \- org.opensaml:opensaml-security-api:jar:3.4.5:compile
[INFO] |  |  |  |  +- org.opensaml:opensaml-soap-api:jar:3.4.5:compile
[INFO] |  |  |  |  +- org.opensaml:opensaml-messaging-api:jar:3.4.5:compile
[INFO] |  |  |  |  +- org.opensaml:opensaml-profile-api:jar:3.4.5:compile
[INFO] |  |  |  |  \- org.opensaml:opensaml-storage-api:jar:3.4.5:compile
[INFO] |  |  |  \- org.opensaml:opensaml-saml-impl:jar:3.4.5:compile
[INFO] |  |  |     +- org.opensaml:opensaml-security-impl:jar:3.4.5:compile
[INFO] |  |  |     +- org.opensaml:opensaml-xmlsec-impl:jar:3.4.5:compile
[INFO] |  |  |     |  \- org.apache.santuario:xmlsec:jar:2.0.10:compile
[INFO] |  |  |     |     \- com.fasterxml.woodstox:woodstox-core:jar:5.0.3:compile
[INFO] |  |  |     |        \- org.codehaus.woodstox:stax2-api:jar:3.1.4:compile
[INFO] |  |  |     +- org.opensaml:opensaml-soap-impl:jar:3.4.5:compile
[INFO] |  |  |     \- org.apache.velocity:velocity:jar:1.7:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-api:jar:2.13.3:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-core:jar:2.13.3:compile
[INFO] |  |  +- org.yaml:snakeyaml:jar:1.26:compile
[INFO] |  |  +- commons-collections:commons-collections:jar:3.2.2:compile
[INFO] |  |  +- org.bouncycastle:bcprov-jdk15on:jar:1.66:compile
[INFO] |  |  +- org.cryptacular:cryptacular:jar:1.2.4:compile
[INFO] |  |  \- org.apache.commons:commons-configuration2:jar:2.7:compile
[INFO] |  |     \- org.apache.commons:commons-text:jar:1.8:compile

And this is the configuration for OAuth

# OAuth2 login manifest
oauth2Login:
  authorizationCode:
    authorizationUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/auth"
    scope:
      - "openid"
      - "finx"
    redirectUriTemplate: "{baseUrl}/login/oauth2/code/{registrationId}"
    tokenUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/token"
    userInfoUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/userinfo"
    jwkSetKeyUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/certs"
    registrationId: "keycloak"
    clientId: "finx_oauth2"
    clientSecret:
      vaultType: PLAIN_TEXT
      secret: "my-secret"
    clientName: "FinX"
    entryPoints:
      - pathMatcher: "/ledger-api/**"
      - pathMatcher: "/ledger-api-internal/**"
      - pathMatcher: "/ledger-api-ui/**"
# OAuth2 resource server
oauth2ResourceServer:
  keySetUri: "http://localhost:8180/auth/realms/master/protocol/openid-connect/certs"
  pathMatchers:
    - "/api/**"
    - "/orchestration-api/**"

I have been digging through the spring source code in order to find the implementation of the endpoint 'oauth2/authorize/keycloak', but this is not an easy task.

So looking for someone who can help me with some pointers on what could be missing/wrong in my configuration.

Upvotes: 1

Views: 5740

Answers (1)

Vijay Nandwana
Vijay Nandwana

Reputation: 2644

By default, the OAuth 2.0 Login Page is auto-generated by the DefaultLoginPageGeneratingFilter.
The login page for a client defaults to this: OAuth2AuthorizationRequestRedirectFilter.DEFAULT_AUTHORIZATION_REQUEST_BASE_URI + "/{registrationId}". As per your configuration, registrationId: "keycloak", this means (/oauth2/authorization/keycloak).

Please check your WebSecurityConfigurerAdapter configuration. Try to override the default login page by configuring oauth2Login().loginPage() and (optionally) oauth2Login().authorizationEndpoint().baseUri().

The following listing shows an example:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .oauth2Login()
            .loginPage("/login/oauth2")
            ...
            .authorizationEndpoint()
                .baseUri("/login/oauth2/authorization")
                ....
}

Please check OAuth 2.0 Login - Advanced Configuration for more information.

Upvotes: 2

Related Questions