java - SSO using spring-security-oauth2 : Authentication Code never read -

java - SSO using spring-security-oauth2 : Authentication Code never read -

using :

spring-security 3.2.5 spring-security-oauth 2.0.7

i have working oauth2 provider built spring-security-oauth (oauth2).

i have client configured in utilize authorization_code grant type.

the provider works : testing curl, can authorization code , exchange access token. on service provider part, fine.

now i'm trying implements client application, spring-security-oauth. i'm using xml configuration, based on illustration here, using own provider (mentionned above) instead of google.

when create phone call protected resource on client, oauth2clientauthenticationprocessingfilter tries obtain access token, redirect service provider. 1 forcefulness user log in, expected, , redirect him configured redirect_uri (the redirect uri 1 configured oauth2clientauthenticationprocessingfilter : http://myclient/context/external/login). problem : the client never read authorization code in request returned service provider. oauth2clientauthenticationprocessingfilter restarts flow, asking authorization code.

i've been able create work modifying oauth2clientauthenticationprocessingfilter read request , set authorization code in accesstokenrequest. here snippet :

oauth2accesstoken accesstoken; seek { string code = request.getparameter("code"); if(code != null) { resttemplate.getoauth2clientcontext().getaccesstokenrequest().setauthorizationcode(code); } accesstoken = resttemplate.getaccesstoken(); ...

before trying this, tried create "call hierarchy" on method org.springframework.security.oauth2.client.token.accesstokenrequest.setauthorizationcode(), find in code spring phone call method, returned nothing.

is bug ? not have replace oauth2clientauthenticationprocessingfilter own.

does made work ( in version or another) ?

update

it's setauthorizationcode() method never called (error in initial question). digged little more , realized not problem.

i can assert oauth2clientcontextfilter called before oauth2clientauthenticationprocessingfilter (i checked debugger).

what found, don't know if normal :

the default constructor of defaultaccesstokenrequest called 1 time : @ application startup. other constructor (the 1 taking parameter's map), never called. since i've seen in resttemplatebeandefinitionparser access token request scoped 'request', expect constructor taking parameter's map called on each new http request client application. in resttemplatebeandefinitionparser :

beandefinitionbuilder request = beandefinitionbuilder.genericbeandefinition(defaultaccesstokenrequest.class); request.setscope("request"); request.setrole(beandefinition.role_infrastructure); request.addconstructorargvalue("#{request.parametermap}"); request.addpropertyvalue("currenturi", "#{request.getattribute('currenturi')}");

that can explain problem authorization code never read request. hack mentionned in initial question pushed problem. csrf protection errors because accesstokenrequest remembers statekey when presume not need anymore 1 time access token.

again, maybe misunderstand hole think, sense free tell me :)

i did not post configuration because it's pretty same that 1 here.

you need oauth2clientcontextfilter , needs fire before authentication processing filter (it stuff have in custom filter). can't tell code posted if have 1 , isn't firing or don't have one.

java spring-security spring-security-oauth2