Spring Boot and Google SSO

Question

I am trying to write a Spring Boot application which will use Google Single sign on (SSO) to authenticate users (it could be any other SSO provider, like Facebook - this example just uses Google).

I followed several tutorials and came up with a very basic setup:

appplication.properties :

security.oauth2.client.client-id: xxx
security.oauth2.client.client-secret: yyy
security.oauth2.client.access-token-uri=https://www.googleapis.com/oauth2/v3/token
security.oauth2.client.user-authorization-uri=https://accounts.google.com/o/oauth2/auth
security.oauth2.client.client-authentication-scheme=query
security.oauth2.client.scope=profile,email
security.oauth2.resource.user-info-uri=https://www.googleapis.com/plus/v1/people/me
security.oauth2.resource.prefer-token-info=false

Controller :

@RestController
public class ExampleController {

    @RequestMapping("/")
    String hello(OAuth2Authentication authentication) {
        return "Hello " + authentication.getName();
    }

    @RequestMapping("/details")
    Object details(OAuth2Authentication authentication) {
        return authentication.getUserAuthentication();
    }
}

Everything works fine in the browser and I get prompted for my Google credentials and only after that I can access my endpoints.

The problem is that I would like to access this API also programatically (for example with cUrl or RestClient ).

I tried the following:

curl xxx:yyy@localhost:8080/my-api/oauth/token -d grant_type=client_credentials

but got the following response:

{"timestamp":1466365089477,"status":403,"error":"Forbidden","message":"Expected CSRF token not found. Has your session expired?","path":"/my-api/oauth/token"}

I am struggling to find some good documentation or tutorials on how to work with SSO Spring Boot Apis programatically. Could someone explain what I am missing or point me to some working tutorial with fully functional multi-user API example?

Answer 1

Have you looked at the Hosting an Authorization Server OAuth 2 and SocialApplication.java examples that are part of Spring Boot?

This example configures a server that's able to grant OAuth tokens using the @EnableAuthorizationServer annotation.

There are also two curl examples that demonstrate how a client can request an access token:

 $ curl acme:acmesecret@localhost:8080/oauth/token -d grant_type=client_credentials {"access_token":"370592fd-b9f8-452d-816a-4fd5c6b4b8a6","token_type":"bearer","expires_in":43199,"scope":"read write"} $ curl acme:acmesecret@localhost:8080/oauth/token -d grant_type=password -d username=user -d password=... {"access_token":"aa49e025-c4fe-4892-86af-15af2e6b72a2","token_type":"bearer","refresh_token":"97a9f978-7aad-4af7-9329-78ff2ce9962d","expires_in":43199,"scope":"read write"}