Spring Boot 2 + OAuth2: Configure Exchange of Auth Code for Token

Question

I've followed this Spring Boot OAuth2 tutorial on configuring an OAuth2 client. Unfortunately, once a "user" authenticates with the Idp (Okta) a redirect with a "code" takes place that results in a redirect loop of: /login -> /authorize... -> /login... -> /login

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

Does anyone know what is or could be the issue and how to solve it? Details follow.

Okta configuration:

Login redirect URIs: http://localhost:8080/auth/login

Logout redirect URIs: http://localhost:8080/auth/logout

Login initiated by: App only

Initiate login URI: http://localhost:8080/auth/login

The configuration properties are:

okta:
  oauth2:
    client:
      client-id: clientId
      client-secret: clientSecret
      scope: openid profile email
      client-authentication-scheme: form
      access-token-uri: https://mydomain.oktapreview.com/oauth2/myapp/v1/token
      user-authorization-uri: https://mydomain.oktapreview.com/oauth2/myapp/v1/authorize
    resource:
      user-info-uri: https://mydomain.oktapreview.com/oauth2/myapp/v1/userinfo

The filter is:

  private Filter filter() {
    OAuth2ClientAuthenticationProcessingFilter filter = new OAuth2ClientAuthenticationProcessingFilter(
        "/login");
    OAuth2RestTemplate restTemplate = new OAuth2RestTemplate(oktaClient(), oauth2ClientContext);
    filter.setRestTemplate(restTemplate);
    UserInfoTokenServices tokenServices = new UserInfoTokenServices(oktaResource().getUserInfoUri(),
        oktaClient().getClientId());
    tokenServices.setRestTemplate(restTemplate);
    filter.setTokenServices(tokenServices);

    return filter;
  }

The WebSecurityConfigurerAdapter configure is:

  @Configuration
  @EnableOAuth2Client
  public class WebSecConfig extends WebSecurityConfigurerAdapter {
  ....
  @Override
  public void configure(HttpSecurity http) throws Exception {
    http.antMatcher("/**").authorizeRequests()
        .antMatchers("/", "/login**", "/logout**", "/v2/api-docs", "/configuration/ui",
            "/configuration/security", "/swagger-resources/**", "/swagger-ui.html", "/webjars/**")
        .permitAll()
        .anyRequest().authenticated().and().exceptionHandling()
        .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login")).and().csrf()
        .csrfTokenRepository(
            CookieCsrfTokenRepository.withHttpOnlyFalse()).and().addFilterBefore(filter(),
        BasicAuthenticationFilter.class);
  }
  ....
  }

Update: Solution was to change LoginUrlAuthenticationEntryPoint("/login") to LoginUrlAuthenticationEntryPoint("/") and re-create the authorization server.

Answer 1

You should use the default authorization server, or one you created. If you use the default, it should look something like:

https://mydomain.oktapreview.com/oauth2/default