Securing your Spring REST service with OAUTH 2 Implicit (password)
Why Stack Overflow recommends it
Stack Overflow users link it as the tutorial they followed when setting up Spring OAuth /oauth/token endpoints, usually when asking why the setup misbehaves.
Recommended by 0 people across 0 different months, 2015 to 2016.
What it is
A 25-minute screencast from ViVSoft Computers LLC walking through setting up OAuth 2 with Spring Security OAuth to protect a RESTful web service, using the password grant flow. It includes the source code, POM and dependency list (Spring 3.2.0, Tomcat 7) in the description, and the presenter notes he is not a security expert.
What people said
Cites Itai · 2015-03 · Stack Overflow · on “Spring OAuth oauth/token returns 404 war on tomcat”
I have followed the example here [this video] to setup OAuth on my spring war application. Since I am using spring 4.0.6.RELEASE and spring-security-oauth2 2.0.7.RELEASE I had to adapt it. HTTP Get on /oauth/token returns 404 (Since my war name is kma.war then the request is to /kma/oauth/token) Security filters seem to work fine according to the logs. But I dont see the call to the TokenEndpoint bean, I even remote debugged and put a breakpoint on it and nothing. Notice the last line in the log below. .08:27:06.798 [http-nio-8080-exec-12] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/oauth/token'; against '/oauth/token' .08:27:06.798 [http-nio-8080-exec-12] DEBUG o.s.s.
Cites singe3 · 2015-09 · Stack Overflow · on “Cannot get access_token (404) with Spring Security OAuth 2.0”
I'm using Spring 4.2.1.RELEASE , Spring Security 4.0.2.RELEASE and Spring Security OAuth 2.0.7.RELEASE to build a web application with a RESTful API. Previously my login functionality wasn't 100% RESTful because I used cookies for authentication. Now I need to move to pure RESTful with token authentication through an OAuth endpoint. I followed many guides, and in particular this one : [this video] When I try to get an access token I make the following request with Postman. HTTP GET [LINK] But I always get a 404 Not Found. I can't find where I'm wrong. Below is my spring security configuration file. ``` <beans:beans xmlns=" [LINK] " xmlns:beans=" [LINK] " xmlns:oauth=" [LINK] " xmlns:xsi=" [LINK]
Cites CodeMed · 2016-04 · Stack Overflow · on “How do /oauth/authorize and /oauth/token interact in Spring OAuth?”
I am doing an in-depth study of Spring OAuth, and I found some conflicting information. Specifically, this tutorial [this video] states that the /oauth/token endpoint handles the username and password before granting a refresh token to the client app. By contrast, the Spring OAuth Developer Guide [LINK] mentions the /oauth/authorize and /oauth/token endpoints, but yet does not get specific about how they work. Does the /oauth/authorize do 100% of the username/password/nOtherFactors check and then signal the /oauth/token endpoint to send a refresh token to the client, so that the client then sends the refresh token to the /oauth/token endpoint? Or is all of it handled by the /oauth/token endpoint?