Odtnhj

I'm working on a spring boot project that uses OAuth 2 authentication (spring boot 1.5). In my solution, I store access token in my postgresql database, on table oauth_access_token.

I migrated my project from spring boot 1.5 to spring boot 2. I did not change anything in my configuration, and I can authenticate myself, but the persistence of the token does not work, my table "oauth_access_token" remain empty.

Here is my OAuth configuration class:

@Configuration
public class OAuth2ServerConfiguration 

 private final DataSource dataSource;

 public OAuth2ServerConfiguration(DataSource dataSource) 
 this.dataSource = dataSource;
 

 @Bean
 public JdbcTokenStore tokenStore() 
 return new JdbcTokenStore(dataSource);
 

 @Configuration
 @EnableResourceServer
 protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter 

 private final TokenStore tokenStore;

 private final Http401UnauthorizedEntryPoint http401UnauthorizedEntryPoint;

 private final AjaxLogoutSuccessHandler ajaxLogoutSuccessHandler;

 private final CorsFilter corsFilter;

 public ResourceServerConfiguration(TokenStore tokenStore, Http401UnauthorizedEntryPoint http401UnauthorizedEntryPoint,
 AjaxLogoutSuccessHandler ajaxLogoutSuccessHandler, CorsFilter corsFilter) 

 this.tokenStore = tokenStore;
 this.http401UnauthorizedEntryPoint = http401UnauthorizedEntryPoint;
 this.ajaxLogoutSuccessHandler = ajaxLogoutSuccessHandler;
 this.corsFilter = corsFilter;
 

 @Override
 public void configure(HttpSecurity http) throws Exception 
 http
 .exceptionHandling()
 .authenticationEntryPoint(http401UnauthorizedEntryPoint)
 .and()
 .logout()
 .logoutUrl("/api/logout")
 .logoutSuccessHandler(ajaxLogoutSuccessHandler)
 .and()
 .csrf()
 .disable()
 .addFilterBefore(corsFilter, UsernamePasswordAuthenticationFilter.class)
 .headers()
 .frameOptions().disable()
 .and()
 .sessionManagement()
 .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
 .and()
 .authorizeRequests()
 .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
 .antMatchers("/api/authenticate").permitAll()
 .antMatchers("/api/register").permitAll()
 .antMatchers("/api/profile-info").permitAll()
 .antMatchers("/api/**").authenticated()
 .antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
 .antMatchers("/v2/api-docs/**").permitAll()
 .antMatchers("/swagger-resources/configuration/ui").permitAll()
 .antMatchers("/swagger-ui/index.html").hasAuthority(AuthoritiesConstants.ADMIN);
 

 @Override
 public void configure(ResourceServerSecurityConfigurer resources) throws Exception 
 resources.resourceId("res_appli").tokenStore(tokenStore);
 
 

 @Configuration
 @EnableAuthorizationServer
 protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter 

 private final AuthenticationManager authenticationManager;

 private final TokenStore tokenStore;

 private final DataSource dataSource;

 public AuthorizationServerConfiguration(@Qualifier("authenticationManagerBean") AuthenticationManager authenticationManager,
 TokenStore tokenStore, DataSource dataSource) 

 this.authenticationManager = authenticationManager;
 this.tokenStore = tokenStore;
 this.dataSource = dataSource;
 

 @Bean
 protected AuthorizationCodeServices authorizationCodeServices() 
 return new JdbcAuthorizationCodeServices(dataSource);
 

 @Bean
 public ApprovalStore approvalStore() 
 return new JdbcApprovalStore(dataSource);
 

 @Override
 public void configure(AuthorizationServerEndpointsConfigurer endpoints)
 throws Exception 
 endpoints
 .authorizationCodeServices(authorizationCodeServices())
 .approvalStore(approvalStore())
 .tokenStore(tokenStore)
 .authenticationManager(authenticationManager);
 

 @Override
 public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception 
 oauthServer.allowFormAuthenticationForClients();
 

 @Override
 public void configure(ClientDetailsServiceConfigurer clients) throws Exception 
 clients.jdbc(dataSource);
 

 

And my security configuration class:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter 

private final AuthenticationManagerBuilder authenticationManagerBuilder;

private final UserDetailsService userDetailsService;

public SecurityConfiguration(AuthenticationManagerBuilder authenticationManagerBuilder, UserDetailsService userDetailsService) 

 this.authenticationManagerBuilder = authenticationManagerBuilder;
 this.userDetailsService = userDetailsService;


@PostConstruct
public void init() 
 try 
 authenticationManagerBuilder
 .userDetailsService(userDetailsService)
 .passwordEncoder(passwordEncoder());
 catch (Exception e) 
 throw new BeanInitializationException("Security configuration failed", e);
 


@Bean
public AjaxLogoutSuccessHandler ajaxLogoutSuccessHandler() 
 return new AjaxLogoutSuccessHandler();


@Bean
public Http401UnauthorizedEntryPoint http401UnauthorizedEntryPoint() 
 return new Http401UnauthorizedEntryPoint();


@Bean
public PasswordEncoder passwordEncoder() 
 return new BCryptPasswordEncoder();


@Override
public void configure(WebSecurity web) throws Exception 
 web.ignoring()
 .antMatchers(HttpMethod.OPTIONS, "/**")
 .antMatchers("/app/**/*.js,html")
 .antMatchers("/i18n/**")
 .antMatchers("/content/**")
 .antMatchers("/swagger-ui/index.html")
 .antMatchers("/api/register")
 .antMatchers("/api/activate")
 .antMatchers("/api/account/reset-password/init")
 .antMatchers("/api/account/reset-password/finish")
 .antMatchers("/test/**");


@Override
public void configure(HttpSecurity http) throws Exception 
 http
 .httpBasic().realmName("yvidya")
 .and()
 .sessionManagement()
 .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
 .and()
 .requestMatchers().antMatchers("/oauth/authorize")
 .and()
 .authorizeRequests()
 .antMatchers("/oauth/authorize").authenticated();


@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception 
 return super.authenticationManagerBean();


@Bean
public SecurityEvaluationContextExtension securityEvaluationContextExtension() 
 return new SecurityEvaluationContextExtension();

And my UserDetailService

@Component("userDetailsService")
public class DomainUserDetailsService implements UserDetailsService 

 private final Logger log = LoggerFactory.getLogger(DomainUserDetailsService.class);

 private final UserRepository userRepository;

 public DomainUserDetailsService(UserRepository userRepository) 
 this.userRepository = userRepository;
 

 @Override
 @Transactional
 public UserDetails loadUserByUsername(final String login) 
 log.debug("Authenticating ", login);
 String lowercaseLogin = login.toLowerCase(Locale.ENGLISH);
 Optional<User> userFromDatabase = userRepository.findOneWithAuthoritiesByLogin(lowercaseLogin);
 return userFromDatabase.map(user -> 
 if (!user.getActivated()) 
 throw new UserNotActivatedException("User " + lowercaseLogin + " was not activated");
 
 List<GrantedAuthority> grantedAuthorities = user.getAuthorities().stream()
 .map(authority -> new SimpleGrantedAuthority(authority.getName()))
 .collect(Collectors.toList());
 return new CustomUser(user, lowercaseLogin, user.getPassword(), grantedAuthorities);
 ).orElseThrow(() -> new UsernameNotFoundException("User " + lowercaseLogin + " was not found in the " +
 "database"));
 

And my file properties contains:

security:
 basic:
 enabled: false
 oauth2:
 resource:
 filter-order: 3

I change nothing in my code, I can get an access token, but it isn't persist un database, I don't know why

Do you have an idea?

Thank you