Spring-security with Oauth2 and LDAP

Question

Nowadays my web application works with spring boot and Spring security without problems, but I need to export a rest service authenticate using Oauth2.

When the user access my web system he is authenticate by a form login with spring security and Active Directory.

When the other system try to consume our Rest Service I would like to use Oauth2 with the same Active Directory.

How can I to do this ? My config with Form Login and Active directory works fine , but we don have idea how to authenticate with Oauth2

My WebSecurityConfig is :

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private LogoutHandler logoutHandler;

    @Autowired
    private AuthenticationSuccessHandler authenticationSuccessHandler;

    @Autowired
    private AccessDeniedHandler accessDeniedHandler;

    @Autowired
    private AuthenticationFailureHandler authenticationFailureHandler;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .authorizeRequests()
            .antMatchers("/rest/public/**").permitAll()
            .and().csrf().ignoringAntMatchers("/rest/public/**").and()
        .authorizeRequests()
            .antMatchers("/public/**").permitAll()
            .antMatchers("/error/**").permitAll()
            .and()
        .authorizeRequests()
            .antMatchers("/adm/**").hasAnyRole(Role.ROOT,Role.ADM)
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login")
            .successHandler(authenticationSuccessHandler)
            .failureHandler(authenticationFailureHandler)
            .defaultSuccessUrl("/home",true)
            .permitAll()
            .and()
        .logout()
            .logoutSuccessUrl("/login")
            .permitAll()
            .addLogoutHandler(logoutHandler)
            .and()
         .exceptionHandling()
            .accessDeniedHandler(accessDeniedHandler);

    }
}

How I can insert Oauth2 authentication only for my Rest Services (this service will be provite by path ../rest/serviceName

Answer 1

You need to configure another filter chain to intercept in your resource server to protect your endpoints via OAuth only.

See my answer to a similar question here