Getting Insufficient scope for this resource using Spring Boot and OAuth2 - api

Question

I'm trying to run a small proof of concept for a REST API using Spring Boot 1.2.2 and secured with OAuth2. In order to do that I created two projects, one for the authentication server and another one for the REST service.
When running the projects, everything goes right. I get a token from the authentication server and then using that token, I managed to call the service and get the expected result.
The issue happens when I try to validate the scopes in the service. As soon as I add the line:
#PreAuthorize("#oauth2.hasScope('webshop')")
to my service, in the code:
#RestController
public class ProductService {
#RequestMapping("/product/{productId}")
#PreAuthorize("#oauth2.hasScope('webshop')")
public Product getProduct(#PathVariable int productId) {
return new Product(productId, "name", 123);
}
}
I get this response:
{
"error": "insufficient_scope",
"error_description": "Insufficient scope for this resource",
"scope": "webshop"
}
The authentication server is configured as:
#Configuration
#EnableAuthorizationServer
protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {
#Autowired
private AuthenticationManager authenticationManager;
#Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.authenticationManager(authenticationManager);
}
#Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory()
.withClient("acme")
.secret("acmesecret")
.authorizedGrantTypes("authorization_code", "refresh_token", "implicit", "password", "client_credentials")
.scopes("webshop");
}
}
This is the actual call to get the token:
juan#ubuntu:~/ms/core/product-service$ curl -s acme:acmesecret#localhost:9999/uaa/oauth/token -d grant_type=client_credentials -d scope=webshop
{
"access_token": "ac3a9768-4ebb-44e3-a49f-21e2f117d0b4",
"token_type": "bearer",
"expires_in": 43199,
"scope": "webshop"
}
And then, to call the service:
juan#ubuntu:~/ms/core/product-service$ TOKEN=ac3a9768-4ebb-44e3-a49f-21e2f117d0b4
juan#ubuntu:~/ms/core/product-service$ curl 'http://localhost:8080/product/32' -H "Authorization: Bearer $TOKEN" -s
{
"error": "insufficient_scope",
"error_description": "Insufficient scope for this resource",
"scope": "webshop"
}
I feel that I am just missing something simple because of lack of a concept. If the client has been created in memory and is supposed to be allowed to do "webshop" and the token has been generated successfully, why is the error generated?
Thanks in advance for pointing to some direction or help.

Answer 1

This is caused by the UserInfoTokenServices class failing to extract the scopes from the request and therefore not adding them to a new OAuth2Request.
Specifically this method
private OAuth2Authentication extractAuthentication(Map<String, Object> map) {
Object principal = getPrincipal(map);
List<GrantedAuthority> authorities = this.authoritiesExtractor
.extractAuthorities(map);
OAuth2Request request = new OAuth2Request(null, this.clientId, null, true, null,
null, null, null, null);
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
principal, "N/A", authorities);
token.setDetails(map);
return new OAuth2Authentication(request, token);
}
neglects to extract the scopes map from the oauth2Request map entry, and then passes a null for the scopes collection into the constructor for the Oauth2Request scope parameter.
This means that even though you might have authorised your user to a particular scope, when the authserver is queried via the security.oauth2.resource.userInfoUri endpoint,the authorised scopes are ignored in the calling code, so the PreAuthorize check fails.
This looks like a bug to me; I've raised an issue on github.