spring - OAuth2 causes Tomcat exceptions -
i tried implement oauth2 maven project. after adding dependency follows:
<dependency> <groupid>org.springframework.security.oauth</groupid> <artifactid>spring-security-oauth2</artifactid> <version>${springsecurityoauth2.version}</version> </dependency>
tomcat throws numerous exceptions:
severe: child container failed during start java.util.concurrent.executionexception: org.apache.catalina.lifecycleexception: failed start component [standardengine[catalina].standardhost[localhost].standardcontext[/springsecurityoauth2example]] @ java.util.concurrent.futuretask.report(futuretask.java:122) @ java.util.concurrent.futuretask.get(futuretask.java:192) @ org.apache.catalina.core.containerbase.startinternal(containerbase.java:939) @ org.apache.catalina.core.standardhost.startinternal(standardhost.java:872) @ org.apache.catalina.util.lifecyclebase.start(lifecyclebase.java:150) @ org.apache.catalina.core.containerbase$startchild.call(containerbase.java:1419) @ org.apache.catalina.core.containerbase$startchild.call(containerbase.java:1409) @ java.util.concurrent.futuretask.run(futuretask.java:266) @ java.util.concurrent.threadpoolexecutor.runworker(threadpoolexecutor.java:1142) @ java.util.concurrent.threadpoolexecutor$worker.run(threadpoolexecutor.java:617) @ java.lang.thread.run(thread.java:745) caused by: org.apache.catalina.lifecycleexception: failed start component [standardengine[catalina].standardhost[localhost].standardcontext[/springsecurityoauth2example]] @ org.apache.catalina.util.lifecyclebase.start(lifecyclebase.java:167) ... 6 more
. . . . , more...
any ideas wrong??
my code:
@configuration @enableglobalmethodsecurity(prepostenabled = true, proxytargetclass = true) public class methodsecurityconfig extends globalmethodsecurityconfiguration { @suppresswarnings("unused") @autowired private oauth2securityconfiguration securityconfig; @override protected methodsecurityexpressionhandler createexpressionhandler() { return new oauth2methodsecurityexpressionhandler(); } } @configuration @enablewebsecurity public class oauth2securityconfiguration extends websecurityconfigureradapter { @autowired private clientdetailsservice clientdetailsservice; @autowired public void globaluserdetails(authenticationmanagerbuilder auth) throws exception { auth.inmemoryauthentication() .withuser("bill").password("abc123").roles("admin").and() .withuser("bob").password("abc123").roles("user"); } @override protected void configure(httpsecurity http) throws exception { http .csrf().disable() .anonymous().disable() .authorizerequests() .antmatchers("/oauth/token").permitall(); } @override @bean public authenticationmanager authenticationmanagerbean() throws exception { return super.authenticationmanagerbean(); } @bean public tokenstore tokenstore() { return new inmemorytokenstore(); } @bean @autowired public tokenstoreuserapprovalhandler userapprovalhandler(tokenstore tokenstore){ tokenstoreuserapprovalhandler handler = new tokenstoreuserapprovalhandler(); handler.settokenstore(tokenstore); handler.setrequestfactory(new defaultoauth2requestfactory(clientdetailsservice)); handler.setclientdetailsservice(clientdetailsservice); return handler; } @bean @autowired public approvalstore approvalstore(tokenstore tokenstore) throws exception { tokenapprovalstore store = new tokenapprovalstore(); store.settokenstore(tokenstore); return store; } } @configuration @enableresourceserver public class resourceserverconfiguration extends resourceserverconfigureradapter { private static final string resource_id = "my_rest_api"; @override public void configure(resourceserversecurityconfigurer resources) { resources.resourceid(resource_id).stateless(false); } @override public void configure(httpsecurity http) throws exception { http. anonymous().disable() .requestmatchers().antmatchers("/user/**") .and().authorizerequests() .antmatchers("/user/**").access("hasrole('admin')") .and().exceptionhandling().accessdeniedhandler(new oauth2accessdeniedhandler()); } } public class securitywebapplicationinitializer extends abstractsecuritywebapplicationinitializer { } @configuration @enableauthorizationserver public class authorizationserverconfiguration extends authorizationserverconfigureradapter { private static string realm="my_oauth_realm"; @autowired private tokenstore tokenstore; @autowired private userapprovalhandler userapprovalhandler; @autowired @qualifier("authenticationmanagerbean") private authenticationmanager authenticationmanager; @override public void configure(clientdetailsserviceconfigurer clients) throws exception { clients.inmemory() .withclient("my-trusted-client") .authorizedgranttypes("password", "authorization_code", "refresh_token", "implicit") .authorities("role_client", "role_trusted_client") .scopes("read", "write", "trust") .secret("secret") .accesstokenvalidityseconds(120).//access token valid 2 minutes. refreshtokenvalidityseconds(600);//refresh token valid 10 minutes. } @override public void configure(authorizationserverendpointsconfigurer endpoints) throws exception { endpoints.tokenstore(tokenstore).userapprovalhandler(userapprovalhandler) .authenticationmanager(authenticationmanager); } @override public void configure(authorizationserversecurityconfigurer oauthserver) throws exception { oauthserver.realm(realm+"/client"); } }
Comments
Post a Comment