Nsryjdtyk

I have two clients (client1, client2) and an OAuth (authorization, resource).

I want to logout from one of clients and the other will be logout. I have tried this spring-boot-oauth2-single-sign-off-logout but this only logout my client1 and client2 is still logged in!

Then I try to revoke my tokens while I use this code below:

String username = principal.getName();

Collection<OAuth2AccessToken> accessTokens = tokenStore.findTokensByClientIdAndUserName("client1", username);

accessTokens.forEach(a -> tokenServices.revokeToken(a.getValue()));

This code did not work, even the client1 is still logged in! While I see my redis is empty and there is no token already, but my client1 is still logged in! How that possible?

===========================================================================
Here is my configuration:

Client - application.yml:

server:

  port: 8081

  servlet:

    context-path: /clt1



spring:

  application:

    name: client1



  thymeleaf: 

    cache: false



security:

  oauth2:

    client:

      client-id: client1 

      client-secret: secret1

      userAuthorizationUri: http://localhost:8000/oa/oauth/authorize

      access-token-uri: http://localhost:8000/oa/oauth/token

      scope: read, write

      #pre-established-redirect-uri: http://localhost:8081/clt1/callback 

      #registered-redirect-uri: http://localhost:8081/clt1/callback

      #use-current-uri: false 

    resource:

      user-info-uri: http://localhost:8000/oa/user 

      #jwt:

      #  key-uri: http://localhost:8000/oa/oauth/token_key 



logging:

  level:

    root: info

Client - SecurityConfig:

@Configuration

@EnableOAuth2Sso

public class SecurityConfig extends WebSecurityConfigurerAdapter {



    @Override

    protected void configure(HttpSecurity http) throws Exception {



        http

            .csrf().disable()

            .antMatcher("/**")

            .authorizeRequests()

            .antMatchers().permitAll()

            .anyRequest().authenticated()

            .and()

            .logout().logoutSuccessUrl("http://localhost:8000/oa/revokeClient").permitAll();

    }



}

Oauth - application.yml:

server:

  port: 8000

  servlet:

    context-path: /oa



spring:

  application:

    name: security



  redis:

    host: 127.0.0.1

    port: 6379



  thymeleaf: 

    cache: false



logging:

  level:

    root: info

Oauth - AuthorizationConfig:

@Configuration

@EnableAuthorizationServer

public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {



    @Autowired

    private TokenStore tokenStore;



    @Autowired

    private PasswordEncoder passwordEncoder;



    @Override

    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        clients

            .inMemory()

            .withClient("client1")

            .secret(passwordEncoder.encode("secret1"))

            .scopes("read", "write")

            .redirectUris("http://localhost:8081/clt1/login")

            .authorizedGrantTypes("authorization_code", "refresh_token")

            .autoApprove(true)

            .and()

            .withClient("client2")

            .secret(passwordEncoder.encode("secret2"))

            .scopes("read", "write")

            .redirectUris("http://localhost:8082/clt2/login")

            .authorizedGrantTypes("authorization_code", "refresh_token")

            .autoApprove(true);

    }



    @Override

    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

        endpoints.tokenStore(tokenStore);

    }



}

Oauth - ResourceConfig:

@Configuration

@EnableResourceServer

public class ResourceServerConfig extends ResourceServerConfigurerAdapter {



    @Override

    public void configure(HttpSecurity http) throws Exception {

        http

            .antMatcher("/**")

            .authorizeRequests().anyRequest().authenticated();

    }



}

Oauth - SecurityConfig:

@Configuration

@EnableWebSecurity

@Order(1)//SecurityConfig >> ResourceConfig

public class SecurityConfig extends WebSecurityConfigurerAdapter {



    @Autowired

    private PasswordEncoder passwordEncoder;



    @Autowired

    private CustomUserDetailsService customUserDetailsService;



    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http

            .csrf().disable()

            .requestMatchers()

            .antMatchers("/loginPage", "/login**", "/registerPage", "/register", "/oauth/authorize", "/revokeClient")

            .and()

            .authorizeRequests()

            .antMatchers("/registerPage", "/register").permitAll()

            .anyRequest()

            .authenticated()

            .and()

            .formLogin().loginPage("/loginPage").loginProcessingUrl("/login").permitAll();



    }



    @Override

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder);

    }



    @Override

    public void configure(WebSecurity web) throws Exception {

        web.ignoring().antMatchers("/css/**", "/docs/**", "/fonts/**", "/img/**", "/js/**", "/plugins/**");

    }



}

Oauth - Application:

@SpringBootApplication

@Configuration

public class SsoDemoOauthApplication {



    @Bean

    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();

    }



    @Autowired

    private RedisConnectionFactory connectionFactory;



    @Bean

    public TokenStore tokenStore() {

        return new RedisTokenStore(connectionFactory);

    }



    public static void main(String args) {

        SpringApplication.run(SsoDemoOauthApplication.class, args);

    }



}

I admit not beeing too clever, but what about putting

.logout().logoutSuccessUrl("http://localhost:8000/oa/logout").permitAll();

instead of

.logout().logoutSuccessUrl("http://localhost:8000/oa/revokeClient").permitAll();

in SecurityConfig of client app? Any drawback?