多个OAuth客户端Spring Security

Question

I have two tables, in each each one differents users , there are two applications web that are connected to my Spring BackEnd, each frontEnd application has one table of users . I want that the user of each table connect with differents clientId and clientSecret. I tried to create two authorization servers but it's appears that wouldn't work.

public class ClientAuthorizationServerConfiguration extends 
AuthorizationServerConfigurerAdapter {

@Autowired 
private ClientConfigurationProperties clientConfiguration;

private TokenStore tokenStore = new InMemoryTokenStore();

@Autowired
@Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;

@Autowired
private RepositoryClientDetailsService clientDetailsService;

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints)
        throws Exception {
    endpoints
            .tokenStore(this.tokenStore)
            .authenticationManager(this.authenticationManager)
            .userDetailsService(clientDetailsService);

}
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws 
Exception {
    clients 
            .inMemory()
            .withClient(clientConfiguration.getClientId())
            .authorizedGrantTypes("password", "refresh_token")
            .authorities("USER")
            .scopes("read", "write")
            .resourceIds(ClientApiResourceServerConfiguration.RESOURCE_ID)
            .secret("{noop}"+clientConfiguration.getClientSecret());

}



@Bean
@Primary
public DefaultTokenServices tokenServices() {
    DefaultTokenServices tokenServices = new DefaultTokenServices();
    tokenServices.setSupportRefreshToken(true);
    tokenServices.setTokenStore(this.tokenStore);
    return tokenServices;
}

@Bean
public PasswordEncoder passwordEncoder() {
  return PasswordEncoderFactories.createDelegatingPasswordEncoder();
}

}

this is my second authorization server

@Configuration
@EnableAuthorizationServer
@Order(1)
public class AuthorizationServerConfiguration extends 
AuthorizationServerConfigurerAdapter {

@Autowired
private ApplicationConfigurationProperties configuration;


@Autowired
private RepositoryClientDetailsService clientDetailsService;




private TokenStore tokenStore = new InMemoryTokenStore();

@Autowired
@Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;

@Autowired
private RepositoryUserDetailsService userDetailsService;

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints)
        throws Exception {
    endpoints
            .tokenStore(this.tokenStore)
            .authenticationManager(this.authenticationManager)
            .userDetailsService(userDetailsService);

}

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws 
Exception {
    clients 
            .inMemory()
            .withClient(configuration.getClientId())
            .authorizedGrantTypes("password", "refresh_token")
            .authorities("USER")
            .scopes("read", "write")
            .resourceIds(RestApiResourceServerConfiguration.RESOURCE_ID)
            .secret("{noop}"+configuration.getClientSecret());

}


@Bean
@Primary
public DefaultTokenServices tokenServices() {
    DefaultTokenServices tokenServices = new DefaultTokenServices();
    tokenServices.setSupportRefreshToken(true);
    tokenServices.setTokenStore(this.tokenStore);
    return tokenServices;
}

@Bean
public PasswordEncoder passwordEncoder() {
  return PasswordEncoderFactories.createDelegatingPasswordEncoder();
}

}

Answer 1

You can add one centralized database, only for authentication purpose. This database will have all clients information (Client ID, Client Secret etc.) and all users information (mostly username and passwords only). Complete user information will remain in their respective databases, but this authentication database will have only user credentials.

All your applications can authenticate themselves using Client Credentials grant type. Spring provides OAuth2RestTemplate to make authenticated REST requests.

All your users (from both applications) can as well authenticate themselves using one centralized authentication server and authentication database.