Htykuut

I'm green to both spring and OAuth, which makes this an exciting problem for me to be stuck on!

From what I gather, what I need to do is create a centralized authorization server with oauth and open ID.

We have a central database of users and we want all of our applications to make a call to the authorization server, login in, automatically approve (since the only traffic should be from our servers) and redirect them based on the URI they pass.

Ideally, we would give them the authorization token and the ID token (open ID) so they have information on the user logged in.

So I am working on setting up a Spring boot application where it acts just as the authorization server. So far, I see the login page - but every single login attempt ends with the following error:

Whitelabel Error Page



This application has no explicit mapping for /error, so you are seeing this as a fallback.

Here is what I have so far for that server:

SpringBootServletInitializer (application initializer) - com.company

@SpringBootApplication

@Configuration

@EnableAutoConfiguration

@ComponentScan

public class Application extends SpringBootServletInitializer {



    public static void main(String args) {

        SpringApplication.run(Application.class, args);

    }

}

AuthorizationServerConfigurerAdapter(auth server) - com.company.config

@Configuration

@EnableAuthorizationServer

public class AuthorizationServer extends AuthorizationServerConfigurerAdapter {



    @Override

    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        clients.inMemory()

            .withClient("my_client")

                .secret("my_secret")

                .autoApprove(true)

                .authorizedGrantTypes("authorization_code", "refresh_token", "password") 

                .scopes("openid")

                .accessTokenValiditySeconds(600);

    }

}

WebSecurityConfigurerAdapter(security) - com.company.config

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity(prePostEnabled = true)

public class SecurityConfig extends WebSecurityConfigurerAdapter {



    @Override

    @Autowired

    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth

            .inMemoryAuthentication()



            .withUser("user").password("password")

            .roles("USER");

    }



    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http

            .formLogin()



            .and()



            .httpBasic().disable()

            .anonymous().disable()

            .authorizeRequests().anyRequest().authenticated();



        // disabled basic auth and configured to use dafault Spring Security form login.

    }

}

So questions:

1. What is that error and why am I seeing it?


2. How do I customize the login page I am seeing? I'm desperately looking around in Spring documentation and I'm lost/overwhelmed. I don't have anything in the resources folder outside of the property file I have.

the error it's from spring being enable to map to an error page, that's because there is an Exception.

you can specify your own login page as follow:

       .formLogin()

          .loginPage("/login.html") //your custom login page

          .defaultSuccessUrl("/homepage.html", true) //welcome page after login success

          .failureUrl("/login.html?error=true") // when AccessDenied happens