Spring Oauth2 Authorization_Grant - cannot access resources after token - User Anonymous

Question

I'm trying to secure my REST Api with authorization grant flow with spring.

I could obtain (with Postman) an access token, i put the authorization into the header with Bearer, but i could not access resources because Spring Security tell me that:

    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository[186] - HttpSession returned null object for SPRING_SECURITY_CONTEXT
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository[116] - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@6e24700e. A new one will be created.
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.h.writers.HstsHeaderWriter[130] - Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@3e385c64
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.security.web.FilterChainProxy[325] - /api/user at position 11 of 14 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.a.AnonymousAuthenticationFilter[100] - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: B1FF11055AA4F347AB8AA7B6E467D93F; Granted Authorities: ROLE_ANONYMOUS'
2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor[219] - Secure object: FilterInvocation: URL: /api/user; Attributes: [authenticated]
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor[348] - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: B1FF11055AA4F347AB8AA7B6E467D93F; Granted Authorities: ROLE_ANONYMOUS
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.access.vote.AffirmativeBased[66] - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@53b3549c, returned: -1
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.a.ExceptionTranslationFilter[173] - Access is denied (user is anonymous); redirecting to authentication entry point
    org.springframework.security.access.AccessDeniedException: Access is denied

So basically, after having obtained the access token, if i use it, i will be an Anonymous User, basically because SPRING_SECURITY_CONTEXT is null...

This is my ResourceServer configuration

@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class ResourceServerConfig extends ResourceServerConfigurerAdapter{

    private final Logger logger = LoggerFactory.getLogger(ResourceServerConfig.class);

    @Autowired
    DataSource dataSource;

     @Override
    public void configure(HttpSecurity http) throws Exception {
                logger.debug("Api security configured");
                http    
                .antMatcher("/api/**")
               .authorizeRequests()
               .anyRequest().access("hasRole('USER')")
               .and().exceptionHandling().authenticationEntryPoint(new Http403ForbiddenEntryPoint())
               .and().httpBasic();
            }

     @Bean
        public TokenStore tokenStore() {
            return new JdbcTokenStore(dataSource);
        }

     @Override
        public void configure(ResourceServerSecurityConfigurer resources) throws Exception {

            resources.tokenStore(tokenStore());
        }
}

This one is the authentication Server

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    DataSource dataSource;

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authManager;

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.jdbc(dataSource);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

        endpoints.tokenStore(tokenStore()).authenticationManager(authManager);

    }

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }

}

I'm trying to access /api/user with this auth Bearer 77a226bf-74a4-4a89-b2a6-e130c215566b which came from the auth server token request after logging in with the user...

What's wrong?

I have same issue, didn`t you solved your problem? – Zufar Muhamadeev Nov 25 '17 at 12:39 — Zufar Muhamadeev, Nov 25 '17 at 12:39

score 0 · Answer 1 · answered Aug 09 '17 at 07:06

I've had exactly the same issue after updating spring boot from 1.4 to 1.5. The problem was solved by disabling boot's autoconfiguration black magic.

@EnableAutoConfiguration(exclude = {OAuth2AutoConfiguration.class})

I believe they've added some new ~~bug~~ feature which breaks old apps config.

score -1 · Answer 2 · answered Apr 06 '17 at 16:11

-1

I think User Role is not getting fetched from the database. Have to define the role column?

This will help you: https://dzone.com/articles/spring-security-4-authenticate-and-authorize-users

answered Apr 06 '17 at 16:11

Nidhi257

613
5
17

The user can login in the web application, so I think its role is correct, the problem only comes when trying to access via the OAUTH flow – besmart Apr 06 '17 at 16:20
can you show me the role column data that store in DB? – Nidhi257 Apr 06 '17 at 16:23
ID | type -> 1 | USER – besmart Apr 06 '17 at 16:29
update the configure method as below: public void configure(HttpSecurity http) throws Exception { http.requestMatchers() .antMatchers("/api/**").and(). authorizeRequests().antMatchers("/api/**") .access("hasRole('USER')") .and().exceptionHandling().authenticationEntryPoint(new Http403ForbiddenEntryPoint()) .and().httpBasic(); } – Nidhi257 Apr 06 '17 at 17:32
getting always the same thing.. SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession – besmart Apr 06 '17 at 17:52

Spring Oauth2 Authorization_Grant - cannot access resources after token - User Anonymous

2 Answers2