Spring OAuth redirect_uri not using https

Question

I have a Spring Boot 1.3.0 application with Spring Security OAuth included as a sort of SSO integration.

The problem is that the application is running in a non-SSL environment with a non-standard port behind a load balancer (F5) that forces SSL and the OAuth provider requires all redirect URLs be registered as https, but the Spring OAuth client (auto-configured with @EnableOAuthSso) will only redirect to the OAuth provider with the following URL...

https://[provider_host]/oauth/authorize?client_id=[redact]&redirect_uri=http://[application_host]/login&response_type=code&scope=[redact]&state=IpMYTe

Note that the return redirect_uri is generated as http. Even though the F5 will force it to https on the way back, our OAuth provider will not allow a non-SSL redirect URI. How can I configure this?

With the exception of my Spring Data JPA controllers, this is the entirety of the app...

AppConfig.java

@SpringBootApplication(exclude = { HibernateJpaAutoConfiguration.class }) @EnableJpaRepositories public class AppConfig extends SpringBootServletInitializer {      public static void main(final String... args) {         SpringApplication.run(AppConfig.class, args);     }      @Autowired     public DataSource dataSource;      @Bean(name = "entityManagerFactory")     public LocalContainerEntityManagerFactoryBean getEntityManagerFactoryInfo() {         final LocalContainerEntityManagerFactoryBean fac = new LocalContainerEntityManagerFactoryBean();         fac.setDataSource(dataSource);         fac.setJpaVendorAdapter(new HibernateJpaVendorAdapter());         fac.setPackagesToScan("[redact]");          final Properties props = new Properties();         props.put("hibernate.dialect", "org.hibernate.dialect.SQLServerDialect");         props.put("hibernate.show_sql", "true");         props.put("hibernate.format_sql", "true");         fac.setJpaProperties(props);          return fac;     }      @Bean(name = "transactionManager")     public PlatformTransactionManager getTransactionManager() {         final JpaTransactionManager transactMngr = new JpaTransactionManager();         transactMngr.setEntityManagerFactory(getEntityManagerFactoryInfo().getObject());         return transactMngr;     }  } 

SecurityConfig.java

@Configuration @EnableOAuth2Sso public class SecurityConfig {  } 

application.properties

server.port=9916 server.contextPath=  server.use-forward-headers=true  security.oauth2.client.clientId=[redact] security.oauth2.client.clientSecret=[redact] security.oauth2.client.scope=[redact] security.oauth2.client.accessTokenUri=https://[provider_host]/oauth/token security.oauth2.client.userAuthorizationUri=https://[provider_host]/oauth/authorize security.oauth2.resource.userInfoUri=https://[provider_host]/oauth/me security.oauth2.resource.preferTokenInfo=false  logging.level.org.springframework=TRACE 

Answer 1

After digging manually through the configuration classes I was able to find and add the following, which did the trick...

security.oauth2.client.pre-established-redirect-uri=https://[application_host]/login security.oauth2.client.registered-redirect-uri=https://[application_host]/login security.oauth2.client.use-current-uri=false 

I'm not convinced there isn't a better way to solve the problem of forcing a HTTPS redirect URL, but this fix worked for me.