PreAuthorize doesn't work

po2040234 · February 20, 2020, 11:49pm

Hi all,

I am doing a POC with one example I found online before jump into my real project.

I already did the authentication part and it seems to be working fine, however, when I am introducing the annotation PreAuthorize it is throwing an error.

{
“ver”: 1,
“jti”: “XXXXXXXXXX”,
“aud”: “api://XXXXXX”,
“iat”: 1582234209,
“exp”: 1582237809,
“cid”: “XXX”,
“uid”: “XXXX”,
“scp”: [
“openid”,
“email”
],
“sub”: “XXXX@westernunion.com”,
“authorities”: [
“ROLE_CC_FLOW”,
“ROLE_ADMIN”,
“ROLE_IBP_FLOW”
]
}

Any help will be much appreciated

Configuration
EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

Override
protected void configure(HttpSecurity http) throws Exception {
    // @formatter:off
    http
        .authorizeRequests().anyRequest().authenticated()
        .and()
        .oauth2ResourceServer().jwt();
    // @formatter:on
    
    http.cors();
    
    Okta.configureResourceServer401ResponseBody(http);
}

}

PreAuthorize(“hasRole(‘ROLE_CC_FLOW’) or #oauth2.clientHasRole(‘ROLE_CC_FLOW’)”)
GetMapping("/cool-cars")
CrossOrigin(origins = “http://localhost:4201”)
public Collection coolCars() {
return repository.findAll().stream()
.filter(this::isCool)
.collect(Collectors.toList());
}

Environment:

org.springframework.boot spring-boot-starter-parent 2.2.4.RELEASE com.okta.spring okta-spring-boot-starter 1.4.0

Error

2020-02-20T15:31:56.530-0800 DEBUG Secure object: FilterInvocation: URL: /cool-cars; Attributes: [authenticated]

2020-02-20T15:31:56.530-0800 DEBUG Previously Authenticated: org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken@3a5cec21: Principal: org.springframework.security.oauth2.jwt.Jwt@c396582f; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: SCOPE_openid, SCOPE_email

2020-02-20T15:31:56.530-0800 DEBUG Voter: org.springframework.security.web.access.expression.WebExpressionVoter@3e3fe0c8, returned: 1

2020-02-20T15:31:56.530-0800 DEBUG Authorization successful

2020-02-20T15:31:56.530-0800 DEBUG RunAsManager did not change Authentication object

2020-02-20T15:31:56.530-0800 DEBUG /cool-cars reached end of additional filter chain; proceeding with original chain

2020-02-20T15:31:56.530-0800 DEBUG GET “/cool-cars”, parameters={}

2020-02-20T15:31:56.531-0800 DEBUG Mapped to com.example.demo.CoolCarController#coolCars()

2020-02-20T15:31:56.531-0800 DEBUG Opening JPA EntityManager in OpenEntityManagerInViewInterceptor

2020-02-20T15:31:56.531-0800 DEBUG Secure object: ReflectiveMethodInvocation: public java.util.Collection com.example.demo.CoolCarController.coolCars(); target is of class [com.example.demo.CoolCarController]; Attributes: [[authorize: ‘#oauth2.throwOnError(hasRole(‘ROLE_CC_FLOW’) or #oauth2.clientHasRole(‘ROLE_CC_FLOW’))’, filter: ‘null’, filterTarget: ‘null’]]

2020-02-20T15:31:56.531-0800 DEBUG Previously Authenticated: org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken@3a5cec21: Principal: org.springframework.security.oauth2.jwt.Jwt@c396582f; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: SCOPE_openid, SCOPE_email

2020-02-20T15:31:56.532-0800 DEBUG Voter: org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter@361d46c5, returned: -1

2020-02-20T15:31:56.532-0800 DEBUG Voter: org.springframework.security.access.vote.RoleVoter@184331fd, returned: 0

2020-02-20T15:31:56.532-0800 DEBUG Voter: org.springframework.security.access.vote.AuthenticatedVoter@71d850ab, returned: 0

2020-02-20T15:31:56.532-0800 DEBUG Closing JPA EntityManager in OpenEntityManagerInViewInterceptor

2020-02-20T15:31:56.532-0800 DEBUG Failed to complete request: org.springframework.security.access.AccessDeniedException: Access is denied

2020-02-20T15:31:56.532-0800 DEBUG Access is denied (user is not anonymous); delegating to AccessDeniedHandler

org.springframework.security.access.AccessDeniedException: Access is denied

at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84)

at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233)

at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:65)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)

at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:747)

at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:689)

at com.example.demo.CoolCarController$$EnhancerBySpringCGLIB$$9e7cd0ad.coolCars()

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:190)

at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138)

at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:106)

at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:888)

at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:793)

at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)

at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1040)

at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:943)

at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)

at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:634)

at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)

at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:320)

at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:126)

at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:90)