ccd-oauth2

An OAuth 2.0 module for CCD applications

Dependencies

ccd-db-0.6.2

Requirement to Install

Oracle Java 8 (http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html)
Maven 3.x - (https://maven.apache.org/download.cgi)

Install

mvn clean install

To add to your Spring application

Add the following to your main class
@Import({CCDOAuth2.class})

Custom Resource Server

The resource server filters requests by authentication. ccd-security-oauth2 uses the default resource server configuration, which does the following:

Disallows access to any resource endpoints by unauthenticated clients
Allows access to endpoints provided by the Spring Security OAuth2 framework

The URLs provided by the Spring Security OAuth2 framework are as follows:

/oauth/authorize the authorization endpoint
/oauth/token the token endpoint
/oauth/confirm_access used by user to post approvals for grants
/oauth/error used to render errors in the authorization server
/oauth/check_token used by Resource Servers to decode access tokens
/oauth/token_key exposes public key for token verification if using JWT tokens

If this configuration is undesirable, you may implement your own ResourceServerConfigurerAdapter with the @EnableResourceServer annotation

Example

Here is a simple authentication example using curl.

# request token
$ curl -u client:secret http://localhost:8080/oauth/token -d grant_type=password -d username=user -d password=pass
# a JSON formatted response with token
{"access_token":"e9dfafa4-efa3-4d0b-8c5d-e393508506eb","token_type":"bearer","refresh_token":"32cc00a1-66a9-4666-aa0c-4de75babfa95","expires_in":43199,"scope":"read write"}
# future requests for resources use this token
$ curl -H "Authorization: Bearer e9dfafa4-efa3-4d0b-8c5d-e393508506eb" http://localhost:8080/

When the access token expires, a request for a new one can be made using the refresh token

# refresh token
$ curl -u client:secret http://localhost:8080/oauth/token -d grant_type=refresh_token -d refresh_token=32cc00a1-66a9-4666-aa0c-4de75babfa95
# a new access token is provided 
{"access_token":"93d1ce4c-522b-45b0-9f04-dd73d7ff5304","token_type":"bearer","refresh_token":"32cc00a1-66a9-4666-aa0c-4de75babfa95","expires_in":42188,"scope":"read write"}