I have below config to validate the access_token from the request Using the resource server api. I have the requirement to validate another access_token which has been set in custom header (Authorization_custom = Bearer blabla....). How do i do that using below configuration to validate both the tokens one by one?
as first priority is to validate the default header "Authorization: Bearer ...." & second validate the custom header "Authorization_custom: Bearer ...." using same resourceServer. Is that possible?
@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
@Autowired
public Environment env;
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.resourceId("sample");
RemoteTokenServices tokenServices = new RemoteTokenServices();
tokenServices.setCheckTokenEndpointUrl(sampleResource().getTokenInfoUri());
tokenServices.setClientId(sampleClient().getClientId());
tokenServices.setClientSecret(sampleClient().getClientSecret());
resources.tokenServices(tokenServices);
resources.authenticationEntryPoint(authenticationEntryPoint());
}
@Override
public void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers(env.getProperty("some.web.base-path") + "/some",
.permitAll().antMatchers("/**")
.authenticated();
}
/** Access the configuration for the token service. */
@Bean
@ConfigurationProperties("some.oauth2.client")
public AuthorizationCodeResourceDetails sampleClient() {
return new AuthorizationCodeResourceDetails();
}
/** Access the configuration for the token validation. */
@Bean
@ConfigurationProperties("some.oauth2.resource")
public ResourceServerProperties sampleResource() {
return new ResourceServerProperties();
}
}
app.yml:
some:
oauth2
client:
clientId: some_resource
clientSecret: some_pass
accessTokenUri: some_uri
userAuthorizationUri: some_uri
tokenName: Bearer
authenticationScheme: header
clientAuthenticationScheme: header
scope:
- email
resource:
userInfoUri: some_uri
tokenInfoUri: some_uri
Comment From: jzheaux
@satscreate, thanks for getting in touch, but it feels like this is a question that would be better suited to Stack Overflow. As mentioned in the guidelines for contributing, we prefer to use GitHub issues only for bugs and enhancements. Feel free to update this issue with a link to the re-posted Stackoverflow question (so that other people can find it) or add more detail if you feel this is a genuine bug.