How do you set a resource ID for a token?

java, oauth-2.0, spring, spring-security

Solution

Turns out that I had to implement the interface ResourceServerConfigurerAdapter. The following implementation works perfectly:

@Configuration
@EnableResourceServer
public class ResourceServer extends ResourceServerConfigurerAdapter{

    @Override 
    public void configure(HttpSecurity http) throws Exception {
         // @formatter:off
         http
         .requestMatchers().antMatchers("/bookmarks", "/bookmarks/**")    
         .and()
         .authorizeRequests().anyRequest().access("#oauth2.hasScope('write')");
         // @formatter:on
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
         resources.resourceId(OAuth2Configuration.RESOURCE_ID);
    }

}

Problem

I try to implement a RESTFul webservice with OAuth using this guide: https://spring.io/guides/tutorials/bookmarks I can successfully retrieve a token: ``` curl -v -u android-bookmarks:123456 -X POST http://localhost:8080/oauth/token -H "Accept: application/json" -d "password=password&username=User1&grant_type=password&scope=write&client_secret=12345&client_id=android-bookmarks" ``` Response: ``` {"access_token":"cdafc45f-924a-4f87-8bd0-e3e2bdffa540","token_type":"bearer","refresh_token":"609efba8-edd3-4ea3-be7b-78e449cec0ef","expires_in":43199,"scope":"write"}* Connection #0 to host localhost left intact ``` When I try to access the resource: ``` curl -G http://localhost:8080/bookmarks -H "Authorization: Bearer cdafc45f-924a-4f87-8bd0-e3e2bdffa540" ``` I get the following response: ``` {"error":"access_denied","error_description":"Invalid token does not contain resource id (oauth2-resource)"} ``` The Java class setting the resource id: ``` @Configuration @EnableResourceServer @EnableAuthorizationServer public class OAuth2Configuration extends AuthorizationServerConfigurerAdapter { public static final String RESOURCE_ID = "bookmarks"; @Autowired AuthenticationManagerBuilder authenticationManager; @Override public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { endpoints.authenticationManager(new AuthenticationManager() { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { return authenticationManager.getOrBuild().authenticate( authentication); } }); } @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception { clients.inMemory() .withClient("android-" + RESOURCE_ID) .authorizedGrantTypes("password", "authorization_code", "refresh_token") .authorities("ROLE_USER") .scopes("write") .secret("123456") .resourceIds(RESOURCE_ID); } } ``` When I change this code to: ``` clients.inMemory() .withClient("android-" + applicationName) .authorizedGrantTypes("password", "authorization_code", "refresh_token") .authorities("ROLE_USER") .scopes("write") .secret("123456"); ``` I can access the resource with the previously mentioned (curl) commands successfully.

Original source