Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why is @EnableOAuth2Sso deprecated?

Tags:

Why is @EnableOAuth2Sso deprecated in Spring Security? That's the only reason why OAuth2 will work for me.

If I remove @EnableOAuth2Sso, then this will not work

@Configuration
@EnableOAuth2Client
@EnableOAuth2Sso <- Need to have this!
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .authorizeRequests()
        .antMatchers("/Intranet/Bokning").authenticated()
        .antMatchers("/**", "/Intranet**").permitAll()
        .anyRequest().authenticated()
        .and().logout().logoutSuccessUrl("/").permitAll();
    }

}

Is there another solution?

like image 862
Nazi Bhattacharya Avatar asked Mar 18 '20 15:03

Nazi Bhattacharya


People also ask

What is the deprecated security for OAuth in spring boot?

The Spring Security OAuth project has reached end of life and is no longer actively maintained by VMware, Inc. This project has been replaced by the OAuth2 support provided by Spring Security and Spring Authorization Server.

What is @EnableOAuth2Sso?

The @EnableOAuth2Sso annotation enables OAuth2 Single Sign On (SSO). By default all the paths are secured. We can customize it using WebSecurityConfigurerAdapter in our Spring Security Java Configuration. We can configure Spring Security OAuth2 using application.

What is the use of ResourceServerConfigurerAdapter?

Class ResourceServerConfigurerAdapter Use this to configure the access rules for secure resources. Add resource-server specific properties (like a resource id).

What is @EnableResourceServer?

@EnableResourceServer annotation means that your service (in terms of OAuth 2.0 - Resource Server) expects an access token in order to process the request. Access token should be obtained from Authorization Server by OAuth 2.0 Client before calling the Resource Server.


1 Answers

This is a solution to latest Spring Security with Facebook OAuth2.0.

Security:

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    public void configure(HttpSecurity http) throws Exception {

        http
        .csrf().disable()
        .authorizeRequests()
        .antMatchers("/Intranet/Bokning").authenticated() // Block this 
        .antMatchers("/**", "/Intranet**").permitAll() // Allow this for all
        .anyRequest().authenticated()
        .and().logout().logoutSuccessUrl("/").permitAll()
        .and()
        .oauth2Login();
    }
}

And appllication.yml

spring:
  security:
    oauth2:
      client:
        registration:
           facebook:
              clientId: myID
              clientSecret: mySecret
              accessTokenUri: https://graph.facebook.com/oauth/access_token
              userAuthorizationUri: https://www.facebook.com/dialog/oauth
              tokenName: oauth_token
              authenticationScheme: query
              clientAuthenticationScheme: form
              resource:
                 userInfoUri: https://graph.facebook.com/me

server:
  port: 8080

And pom.xml file:

    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-oauth2-client</artifactId>
    </dependency>
like image 104
Nazi Bhattacharya Avatar answered Oct 11 '22 20:10

Nazi Bhattacharya