Nsryjdtyk

I try to write my own custom oauth2 based Authorization Server for my web application. I planned it something like this:

I want to authenticate through login form available in my angular app. Than I want to access with my angular app protected resources using JWT Token generated by my authorization service. Currently I am unable to login to my application, because server responds with exception:

org.springframework.security.access.AccessDeniedException: Access is denied

at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124) ~[spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) ~[spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119) ~[spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:176) [spring-security-oauth2-2.2.1.RELEASE.jar:na]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.4.RELEASE.jar:5.0.4.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.4.RELEASE.jar:5.0.4.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.debug.DebugFilter.invokeWithWrappedRequest(DebugFilter.java:90) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.security.web.debug.DebugFilter.doFilter(DebugFilter.java:77) [spring-security-web-5.0.3.RELEASE.jar:5.0.3.RELEASE]

at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357) [spring-web-5.0.4.RELEASE.jar:5.0.4.RELEASE]

at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270) [spring-web-5.0.4.RELEASE.jar:5.0.4.RELEASE]

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) [spring-web-5.0.4.RELEASE.jar:5.0.4.RELEASE]

at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.4.RELEASE.jar:5.0.4.RELEASE]

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) [tomcat-embed-core-8.5.28.jar:8.5.28]

at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.28.jar:8.5.28]

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_192-ea]

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_192-ea]

at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.28.jar:8.5.28]

at java.lang.Thread.run(Thread.java:748) [na:1.8.0_192-ea]

I enabled debug mode and logs before exceptions looks like this

    2018-11-22 18:31:18.110 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/oauth/token']

2018-11-22 18:31:18.110 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/oauth/token'

2018-11-22 18:31:18.110 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/oauth/token_key']

2018-11-22 18:31:18.110 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/oauth/token_key'

2018-11-22 18:31:18.110 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/oauth/check_token']

2018-11-22 18:31:18.110 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/oauth/check_token'

2018-11-22 18:31:18.110 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : No matches found

2018-11-22 18:31:18.110 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'

2018-11-22 18:31:20.309 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'

2018-11-22 18:31:20.310 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', GET]

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'POST /login' doesn't match 'GET /logout

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', POST]

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/logout'

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', PUT]

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'POST /login' doesn't match 'PUT /logout

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/logout', DELETE]

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'POST /login' doesn't match 'DELETE /logout

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.web.util.matcher.OrRequestMatcher  : No matches found

2018-11-22 18:31:20.311 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 5 of 11 in additional filter chain; firing Filter: 'OAuth2AuthenticationProcessingFilter'

2018-11-22 18:31:20.312 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.o.p.a.BearerTokenExtractor         : Token not found in headers. Trying request parameters.

2018-11-22 18:31:20.312 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.o.p.a.BearerTokenExtractor         : Token not found in request parameters.  Not an OAuth2 request.

2018-11-22 18:31:20.312 DEBUG 8476 --- [nio-8082-exec-1] p.a.OAuth2AuthenticationProcessingFilter : No token in request, will continue chain.

2018-11-22 18:31:20.312 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'

2018-11-22 18:31:20.313 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'

2018-11-22 18:31:20.314 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'

2018-11-22 18:31:20.314 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.a.AnonymousAuthenticationFilter  : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@458c3963: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'

2018-11-22 18:31:20.314 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'

2018-11-22 18:31:20.314 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'

2018-11-22 18:31:20.314 DEBUG 8476 --- [nio-8082-exec-1] o.s.security.web.FilterChainProxy        : /login at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'

2018-11-22 18:31:20.315 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.a.i.FilterSecurityInterceptor    : Secure object: FilterInvocation: URL: /login; Attributes: [#oauth2.throwOnError(authenticated)]

2018-11-22 18:31:20.315 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.a.i.FilterSecurityInterceptor    : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@458c3963: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS

2018-11-22 18:31:20.319 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.access.vote.AffirmativeBased       : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@11646bb9, returned: -1

2018-11-22 18:31:20.324 DEBUG 8476 --- [nio-8082-exec-1] o.s.s.w.a.ExceptionTranslationFilter     : Access is denied (user is anonymous); redirecting to authentication entry point

My configuration classes looks like this

@Configuration

@EnableAuthorizationServer

@EnableGlobalMethodSecurity(prePostEnabled = true)

class OAuth2Config(

        private val dataSource: DataSource,

        private val authenticationManager: AuthenticationManager,

        private val userDetailsService: UserDetailsService,

        private val bCryptPasswordEncoder: BCryptPasswordEncoder

) : AuthorizationServerConfigurerAdapter() {



    @Bean

    fun tokenStore(): JdbcTokenStore {

        return JdbcTokenStore(dataSource)

    }



    @Bean

    fun oauthAccessDeniedHandler(): OAuth2AccessDeniedHandler {

        return OAuth2AccessDeniedHandler()

    }



    @Bean

    fun accessTokenConverter(): JwtAccessTokenConverter {

        return JwtAccessTokenConverter()

    }



    override fun configure(oauthServer: AuthorizationServerSecurityConfigurer) {

        oauthServer

                .tokenKeyAccess("permitAll()")

                .checkTokenAccess("isAuthenticated()")

                .passwordEncoder(bCryptPasswordEncoder)

    }



    override fun configure(clients: ClientDetailsServiceConfigurer) {

        clients.jdbc(dataSource)

    }



    override fun configure(endpoints: AuthorizationServerEndpointsConfigurer) {

        endpoints.tokenStore(tokenStore()).authenticationManager(authenticationManager).userDetailsService(userDetailsService)

    }

}



@Configuration

@EnableWebSecurity(debug = true)

class ServerSecurityConfig(

        private val userDetailsService: UserDetailsService

) : WebSecurityConfigurerAdapter() {



    @Bean

    fun bCryptPasswordEncoder(): BCryptPasswordEncoder {

        return BCryptPasswordEncoder()

    }



    @Bean

    override fun authenticationManagerBean(): AuthenticationManager {

        return super.authenticationManagerBean()

    }





    override fun configure(auth: AuthenticationManagerBuilder) {

        auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder())

    }



    override fun configure(http: HttpSecurity) {

        http.cors() 

                .and()

                .csrf().disable()

                .headers().frameOptions().sameOrigin() 

                .and()

    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

    }



}

Change your configuration with this

List<String> permitAllEndpointList = Arrays.asList(

                AUTHENTICATION_URL,

                REFRESH_TOKEN_URL);

    http.cors() 

    .and()

    .csrf().disable()

    .headers().frameOptions().sameOrigin() 

    .and()

    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

    .and()

    .authorizeRequests()

    .antMatchers(permitAllEndpointList.toArray(new String[permitAllEndpointList.size()]))

    .permitAll()

This will give permission to auth and refresh token urls. You can add new urls to list.

My problem lied in my lack of understanding of Oauth 2.0. Based on baeldung blog articles and baeldung github project I was able to create my own solution which is available on my github