Spring Security OAuth2 JWT 匿名令牌

Question

What I Did

First I accept that I am lacking in spring security knowledge.

I am trying secure rest services for one of our product. I am using spring security OAuth2 JWT. I want to allow anonymous as well as registered users to access my resources.

Suppose I have one service " http://localhost:8282/melayer/articles " and when I run following command

(1). curl -X POST -vu melayer:12345 http://localhost:8282/melayer/oauth/token -H "Accept: application/json" -d "password=melayer&username=melayer&grant_type=password&scope=write&client_secret=12345&client_id=melayer"

I am able to receive access_token, refresh_token etc. Everything works fantastic, even I can access url http://localhost:8282/melayer/articles with received acces_token

(2). curl http://localhost:8282/melayer/articles -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0NjA3NzY5NDIsInVzZXJfbmFtZSI6ImVjb2tyeXB0IiwianRpIjoiNWI5ZmE4NjYtMTBlNS00NDA2LTgxYmMtYjM3NWVmNGE0ZmQ1IiwiY2xpZW50X2lkIjoiZWNva3J5cHQiLCJzY29wZSI6WyJ3cml0ZSJdfQ.4jO9euBz4TSSNh7M3l2YBD1QPblE0ZyOfGm4VtyFMFY"

What I want to understand

I want to receive access_token anonymously ie I dont want to pass user name, password or client secret, I want to run curl command in following way

curl -X POST http://localhost:8282/melayer/oauth/token -H "Accept: application/json"

My one of the concern is, I want access_token with or without user credentials I am trying to achieve this from last week, Am I missing something ? is it possible ? what is correct way to do this ?

It is kind request to help me on this :)

If anyone want to see my code please refer Git repo https://github.com/aniruddhha/spring-security-oauth2-jwt

Answer 1

I think you Misunderstood the access token concept, access tokens are meant to be used on behalf of authenticated user.

OAuth2 supports different grants types (password, authorization_code, etc) , check the spec Oauth2 Spec

In order to authenticate used you can use any one of those grants or could create your own (eg: login with Google token ) but you must send some form of user credentials to identify the user and the client credentials to identify the client.

Access token cannot be used as some kind of ApiKey used to access public api