# 403 error instead of okta login form (Spring Boot)

**URL:** <https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757>\
**Category:** Questions\
**Tags:** java\
**Created:** [November 16, 2020, 4:26pm UTC](https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757 "2020-11-16T16:26:29Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![IndianaJohan](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@IndianaJohan](https://devforum.okta.com/u/IndianaJohan)\
**Post date:** [November 16, 2020, 4:26pm UTC](https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757/1 "2020-11-16T16:26:29Z")

</div>

I’m trying to add authentication to my Spring Boot app, with this tutorial :

> **[Add User Authentication to Your Spring Boot App in 15 Minutes](https://developer.okta.com/blog/2018/10/05/build-a-spring-boot-app-with-user-authentication)**
>
> Spring Boot makes it fun and easy to build Java webapps. This blog post shows you how to add user authentication to a Spring Boot app.

I created a “restricted” page, with this rule :  
`http.authorizeRequests() .antMatchers("/home").permitAll() .antMatchers("/restricted").authenticated();`

But the restricted page do not go to okta login form. Instead, I have a 403 error (shown by my custom ErrorController)

Do you know how to investigate ?

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [November 16, 2020, 5:45pm UTC](https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757/2 "2020-11-16T17:45:37Z")

</div>

What version of Spring Boot and the Okta Spring Boot starter are you using? The tutorial you’re referencing uses `@EnableOAuth2Sso` and uses Spring Boot v2.0.5.RELEASE.

The current version (1.4.0) of our Okta Spring Boot starter works with Spring Boot 2.2+. If you need support for Spring Boot 1.5.x, use version 0.6.

With Spring Boot 2.2, you’ll use Spring Security’s DSL to configure it to login with `oauth2Login()`. For example:

```java
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
                .antMatchers("/home").permitAll()
                .anyRequest().authenticated()
            .and().oauth2Login();
    }
}

```

---

<div class="post-metadata">

**Author:** ![IndianaJohan](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@IndianaJohan](https://devforum.okta.com/u/IndianaJohan)\
**Post date:** [November 17, 2020, 10:57am UTC](https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757/3 "2020-11-17T10:57:36Z")

</div>

I use Spring Boot v1.5.4.RELEASE, so yes I took the v0.6.0 of Okta.

Here are the dependencies that I added :

```
<dependency>
        <groupId>com.okta.spring</groupId>
        <artifactId>okta-spring-boot-starter</artifactId>
        <version>0.6.0</version>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
        <version>2.4.0</version>
    </dependency>

    <dependency>
        <groupId>org.thymeleaf.extras</groupId>
        <artifactId>thymeleaf-extras-springsecurity4</artifactId>
        <version>2.1.2.RELEASE</version>
    </dependency>

    <dependency>
        <groupId>org.springframework.security.oauth.boot</groupId>
        <artifactId>spring-security-oauth2-autoconfigure</artifactId>
        <version>2.3.4.RELEASE</version>
    </dependency>
```

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [November 17, 2020, 2:52pm UTC](https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757/4 "2020-11-17T14:52:19Z")

</div>

You don’t need `spring-boot-starter-security` as the Okta starter includes that. I believe you can remove the other Spring OAuth dependency too. If that doesn’t work, the Spring OAuth dependency probably needs to match your Spring Boot version.

---

<div class="post-metadata">

**Author:** ![IndianaJohan](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@IndianaJohan](https://devforum.okta.com/u/IndianaJohan)\
**Post date:** [November 17, 2020, 3:44pm UTC](https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757/5 "2020-11-17T15:44:31Z")

</div>

The Spring OAuth dependency is no more available at version 1.5.4.RELEASE in the mvn repository

> **[Maven Repository: org.springframework.security.oauth.boot »...](https://mvnrepository.com/artifact/org.springframework.security.oauth.boot/spring-security-oauth2-autoconfigure)**

I can remove the two mentionned dependencies, but I still have the issue 😐

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [November 17, 2020, 4:56pm UTC](https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757/6 "2020-11-17T16:56:03Z")

</div>

If you’re able to use Spring 2.2+, this tutorial is more recent and will likely work better for you.

> **[OAuth 2.0 Java Guide: Secure Your App in 5 Minutes](https://developer.okta.com/blog/2019/10/30/java-oauth2)**
>
> Learn how to create a Java application with Spring and secure it with OAuth 2.0 in 5 minutes.

---

<div class="post-metadata">

**Author:** ![IndianaJohan](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@IndianaJohan](https://devforum.okta.com/u/IndianaJohan)\
**Post date:** [November 17, 2020, 5:56pm UTC](https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757/7 "2020-11-17T17:56:31Z")

</div>

Ok, I will try it later.  
Thank you for your answers.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [November 18, 2020, 5:56pm UTC](https://devforum.okta.com/t/403-error-instead-of-okta-login-form-spring-boot/11757/8 "2020-11-18T17:56:33Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.