Databases
StackOverflow2013
Postsdbo
POSpring security oauth2 - getting custom data from OAuth2 principal
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSpring security oauth2 - getting custom data from OAuth2 principal
    primarykey
    data
    text
    <p>I have a site that uses Spring security and has users (username &amp; password) and standard form authentication. I allow users to generate a client Id and client secret linked to their account for use with an OAuth2 secured rest API. </p> <p>I use a separate client id &amp; client secret for the API and not username and password so the user can change their password etc without breaking the API credentials, set specific scopes, disable API access etc.</p> <p>I use spring-security-oauth2 (provider) to secure the rest API and I have allowed a client credentials flow. I have setup client authentication for the api so that client id and secret are checked.</p> <p>From a separate application I use the client id and client secret to retreive an access token and start to use it with the api. For the most part I use simple @PreAuthorize expressions typically based on client roles and scope and these appear to work correctly.</p> <p><strong>All above appears to work fine</strong></p> <p>However... I have a few API endpoints now however where I need to implement some more complex rules based on some details from the underlying user - in this case the user that generated the client id and secret.</p> <p>As a simple example consider a messaging application where I have an endpoint that allows users to post a new "message" of a specific type that can vary. I have a table of allowed recipients for each user and each type and I want to check that the recipients of the posted message match the allowed recipient for the type. (User allowed recipients data is typically not large, and rarely changes so I'm happy to store a copy of it when generating an access token)</p> <p>I get the principal at these endpoints and I see it is an instance of OAuth2Authentication containing:</p> <ul> <li>userAuthentication - null - This seems expectable for client credentials flow.</li> <li>clientAuthentication is populated and authorizationParameters contains the grant type and client_id</li> </ul> <p>I suppose I could use the client id from clientAuthentication.authorizationParameters to lookup the user and the details I require, but that would be a few queries each api call which doesn't seem to make sense.</p> <p>I would guess there's a nice place/way in Spring OAuth2 libs that while granting the access token that I could add some extra details so that later I could get them from the OAuth2Authentication (principal) object (or something that extends it?)</p> <p>Alternatively is there a better approach entirely to such issue?</p> <p>Thx!</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USMark Doyle
    1. USMark Doyle
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POSpring security oauth2 - getting custom data from OAuth2 principal
      1. USMark Doyle
      1. VTFavorite
    2. VO
      singulars
      1. POSpring security oauth2 - getting custom data from OAuth2 principal
      1. USMark Doyle
      1. VTBountyStart
    3. VO
      singulars
      1. POSpring security oauth2 - getting custom data from OAuth2 principal
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload