OAuth2 security filter chain totally ignored

[allfro]

Hello all,

I am trying to setup a server that is both an Authorization and Resource server. The following are my configuration classes:

1: OAuth2ServerConfig.java

@Configuration
public class OAuth2ServerConfig {
    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

        @Override
        public void configure(HttpSecurity http) throws Exception {
            http
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                    .and()
                    .requestMatchers().antMatchers("/admin/**")
                    .and()
                    .authorizeRequests()
                    .antMatchers("/admin/test").access("#oauth2.hasScope('admin')");
        }

        @Override
        public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
            resources
                    .resourceId("test")
                    .stateless(false);
        }
    }
}

2: WebSecurityConfig.java

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers(
                "/access-denied.html",
                "/js/**",
                "/css/**",
                "/img/**",
                "/oauth/uncache_approvals",
                "/oauth/cache_approvals",
                "/oauth/token_key"
        );
    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf()
                .and()
                .anonymous()
                .principal("anonymous")
                .and()
                .authorizeRequests()
                .antMatchers(
                        "/user/register",
                        "/password/reset",
                        "/verify/account",
                        "/verify/password/reset"
                ).anonymous()
                .antMatchers("/login.html", "/password/expired", "/policies/**").permitAll()
                .anyRequest().hasRole("USER")
                .and()
                .exceptionHandling()
                .accessDeniedHandler(
                        new DelegatingAccessDeniedHandler(
                                new LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler>() {{
                                    put(CsrfException.class, new CsrfAccessDeniedHandler());
                                }},
                                defaultAccessDeniedHandler()
                        )
                )
                .and()
                .logout()
                .logoutUrl("/logout")
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout", "GET"))
                .logoutSuccessUrl("/login.html")
                .and()
                .formLogin()
                .loginProcessingUrl("/login")
                .failureHandler(authenticationFailureHandler())
                .loginPage("/login.html");
    }

}

When I try to hit the endpoint /admin/test I get redirected to the login page which suggests that the default spring security filter chain is being used. Upon debugging the AbstractSecurityInterceptor I can see that indeed the spring security filter chain is being used as the security attributes that are being fetched are hasRole('USER') (specified as one of the rules).

I commented the line .anyRequest().hasRole("USER") out to see if there is any effect but sadly, no. Instead, no spring security rules OAuth2 or otherwise are being applied. Requests appear to flow through without any access control.

I also tried reordering the configuration classes by using @Order(99) on the ResourceConfiguration class but that also did not work. I am not sure how to solve this issue after looking at many other issues with the same problem and applying the same recommendations. Your thoughts would be greatly appreciated @dsyer.

[dsyer]

Not really sure what problem you are trying to solve, but /admin/test doesn't match your resource server filter so there wouldn't be any oauth2 constraints in it at all. This really seems like a usage question (so much better on StackOverflow if you don't mind).

[allfro]

No issue but before I take it to SO, I'm not sure what you mean by they don't match? The code in github reflects matching paths. If you are referring to the code you received via email there was a typo while I was changing the names of the paths for this example.

[dsyer]

Is it a spring boot app (what version?).

[allfro]

Yes it's a spring boot app. Here's a copy of my pom.xml if you're interested in knowing what's been added to the project:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://maven.apache.org/POM/4.0.0"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <parent>
        <artifactId>idp</artifactId>
        <groupId>com.foo</groupId>
        <version>1.0</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>

    <artifactId>idp</artifactId>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-mongodb</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security.oauth</groupId>
            <artifactId>spring-security-oauth2</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-jwt</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.batch</groupId>
            <artifactId>spring-batch-infrastructure</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
            <optional>true</optional>
        </dependency>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <mainClass>com.foo.IdpApplication</mainClass>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>

The parent references the following artifact:

<parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.5.1.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

[allfro]

Hi @dsyer,

Thanks for all your input. Turns out one of the other modules included in the project had a WebSecurityConfigurerAdapter to register a filter. I removed that class and let spring take care of filter registration using its dynamic filter registration mechanism. Everything works fine now. I was under the impression that multiple WebSecurityConfigurerAdapter implementations would simply append to the end of the pre-existing HttpSecurity configuration.

Cheers,

Nadeem