Nsryjdtyk

I am using java spring security for my REST api using implicit oauth2 implementation. However alike in java spring security for MVC, i am not able to find/implement custom failureHandler for REST API security configuration for implementing logic to handle login attempts. Can you please suggest how can i implement the same.

@EnableWebSecurity

@EnableGlobalMethodSecurity(prePostEnabled=true)

public class SecurityConfig extends WebSecurityConfigurerAdapter {

.....

@Override

    protected void configure(HttpSecurity http) throws Exception {

         http

         .csrf().disable()

         .authorizeRequests()

            .antMatchers("/api/**").permitAll()

            .antMatchers("/rest/**").permitAll()

            .antMatchers("/secureapi/**").authenticated()

         .and()

         .formLogin() //New added need to check

         .and()

         .exceptionHandling().authenticationEntryPoint(getBasicAuthEntryPoint())

         .and()

         .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

    }

}

Authorization Server:

@EnableAuthorizationServer

public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

.....

    @Override

    public void configure(ClientDetailsServiceConfigurer configurer) throws Exception {

    configurer

        .inMemory()

        .withClient(CLIENT_ID)

        .secret(CLIENT_SECRET)

        .authorizedGrantTypes(GRANT_TYPE, AUTHORIZATION_CODE, REFRESH_TOKEN, IMPLICIT )

        .scopes(SCOPE_READ, SCOPE_WRITE, TRUST)

        .accessTokenValiditySeconds(ACCESS_TOKEN_VALIDITY_SECONDS)

        .refreshTokenValiditySeconds(REFRESH_TOKEN_VALIDITY_SECONDS);

    }



    @Override

    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

        endpoints.tokenStore(tokenStore).authenticationManager(authenticationManager).tokenEnhancer(CustomTokenEnhancer);

    }



    @Override

        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {

            oauthServer.realm(REALM+"/client");

        }

    }

}

Resource Server:

@EnableResourceServer

public class ResourceServerConfig extends ResourceServerConfigurerAdapter {



    private static final String RESOURCE_ID = "resource_id";



    @Override

    public void configure(ResourceServerSecurityConfigurer resources) {

        resources.resourceId(RESOURCE_ID).stateless(false);

    }



    @Override

    public void configure(HttpSecurity http) throws Exception {

        http.

                anonymous().disable()

                .authorizeRequests()

                        .antMatchers("/secureapi/**").authenticated()

                .and().exceptionHandling()

                        .accessDeniedHandler(new OAuth2AccessDeniedHandler());

    }



}