Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

OAuth2ResourceServerSpec should allow its ServerBearerTokenAuthenticationConverter to be configurable

See original GitHub issue

Currently in ServerHttpSecurity.OAuth2ResourceServerSpec.JwtSpec.configure(ServerHttpSecurity) the ServerBearerTokenAuthenticationConverter is hard-coded in the configure method. The non-reactive side (OAuth2ResourceServerConfigurer) allows for the user to supply a BearerTokenResolver. The reactive side should allow for the same.

I propose adding similar functionality to ServerHttpSecurity.OAuth2ResourceServerSpec for this.

I’m happy to supply a PR for this if you would like.

Issue Analytics

State:
Created 5 years ago
Comments:5 (5 by maintainers)

Top GitHub Comments

2reactions

jzheauxcommented, Nov 29, 2018

@edeandrea So, we do have ServerAuthenticationConverter, which I think would suffice for this case.

And since an extra interface is really only saving the user a couple of lines (going from String to Authentication), we can probably afford to wait on that.

Note that this is how the same functionality is exposed in OAuth2Login, so it’s also nice to stay consistent where possible.

0reactions

edeandreacommented, Nov 29, 2018

I just submitted #6190

Top Results From Across the Web

Configure Spring Security 5 Oauth 2 to use access_token uri ...

I am creating a OAuth2 resource server. Unfortunately the OAuth2ResourceServerSpec does not allow authenticationConverter to be set. spring ...

OAuth 2.0 Resource Server :: Spring Security

When this property and these dependencies are used, Resource Server will automatically configure itself to validate JWT-encoded Bearer Tokens. It achieves ...

spring-projects/spring-security - Gitter

OAuth2ResourceServerSpec the default ServerBearerTokenAuthenticationConverter is not overridable like it is on the servlet side (i.e. BearerTokenResolver )?.

org.springframework.security.web.server ... - Tabnine

ServerHttpSecurity$OAuth2ResourceServerSpec$JwtSpec.configure(. ... implemented logic in AuthenticationWebFilter and set a custom * SuccessHandler that will ...

org.springframework.security.config.web.server.ServerHttpSecurity ...

It allows configuring web based security for specific http requests. ... If neither has been configured, the Cors configuration will do nothing.