A Quick Guide to OAuth 2.0 with Spring Security

Developer Blog Comments
41

Ole

Using your example everything seems to work until the redirect from the authorization server on 8081 to the web page on 8082. The uri /login/oauth2/code returns a 404. What am I missing?

42

Matt Raible

Are you using the same versions that this post uses? You can compare your code to example app on GitHub if it helps.

43

Ole

I have went through it line by line and everything matches up as far as I can tell. Where does the html for /login/oauth2/code/ come from? Should I be able to render localhost:8082/login/oauth2/code from my browser?

44

Matt Raible

No, you should not be able to render this in your browser. Spring Security uses this to redirect to your identity provider’s authorize endpoint to authenticate. See Spring Security’s documentation for more information.

45

Ole

Do I need to add an endpoint to my controller to support this? How do I handle this call back so I can add granted authorities and properly return it to the calling application?

46

Ole

I expected to see a page in my browser displaying the username. I do not see that page and I am unsure why it is not rendering.

47

Matt Raible

The Okta Spring Boot Starter is a thin wrapper around Spring Security’s OIDC libraries to make things a bit easier. If you add it to your classpath, these endpoints will be made available by Spring Security. If you want to customize the default behavior, you can create a SecurityConfiguration class that does that. This post has an example:


@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/**").authorizeRequests()
            .antMatchers("/").permitAll()
            .anyRequest().authenticated()
            .and()
            .oauth2Login();
    }
}

48

Matt Raible

I’d recommend trying our Okta CLI and okta start spring-boot. It should help to get things setup quickly and display your username after logging in. https://developer.okta.com/…

49

Matt Raible

Our blog post on Scaling Secure Applications with Spring Session and Redis might help.

50

sai

@EnableResourceServer deprecated what is alternative to this?

51

Matt Raible

Spring Security’s DSL: https://developer.okta.com/…

52

Mr Roul

The login redirect URL giving 404 :

https://xxxxx-stage.okta.co…

- /oauth2/ not present in the url, when I added it manually and try to see if I’m getting the Okta login page but there again I’m getting error “scope” not found in request.

53

Matt Raible

It looks like you’re trying to use your Org authorization server rather than the default custom authorization server (AS). You need to have a custom AS for this tutorial. If you create a developer account, a custom AS will be created for you and it’ll be named “default”. You should be able to see it under Security > API. You can read more about the difference between the two in https://developer.okta.com/….

54

Mr Roul

How can I configure Authorization in my spring boot application for Org Okta authorization server ?

55

Matt Raible

You can’t. However, you can create a new developer account and it’ll include API access management for free.

56

shanmukha varma

hey i know how to integegrate okta and fitbit api using springboot