Develop Reference

Force User to Reenter Oauth Credentials After Logout | Spring Security

I have a Spring application that is secured using Oauth provided by Twitch. What I am trying to do is make it so that when the user clicks the logout button they have to reenter their Twitch credentials to log back into the site. From the reading I have done my understanding of the situation is that single sign off is fairly hard to achieve with Oauth. That said, Twitch's API seems to indicate that there is a way to tell them to invalidate an Oauth token: https://dev.twitch.tv/docs/authentication#revoking-access-tokens.
I have seen some information about a prompt=login parameter in OIDC but I have not been able to find any information about it or how to use it (on top of that I'm pretty sure that will require the users to reenter their credentials EVERY time rather than simply when they logout).
My initial approach to this problem was the number 1 answer in this thread but that did not actually change anything. I still was not required to enter my credentials upon trying to access one of the restricted endpoints, Spring simply quickly reauthenticated with Twitch and sent me through.
My current approach was to directly hit the endpoint in the Twitch api with a POST request (this was inspired by a comment in this thread). This approach is also not doing anything. I will include the code of that approach below.
I would much prefer to solve this problem with something built into Spring (holding out hope that there is something that I have somehow missed). An interesting thing I have been noticing happening is that when I hit /logout my browser will be redirected to Twitch's authorization endpoint which is making me think that for some reason Spring is trying to send a token revoke request to the authorization endpoint OR is logging me back into the endpoint as soon as I am logged out of it. Thought this was worth mentioning.
Any help replicating the initially mentioned behavior would be much appreciated.
SpringSecurityConfiguration:
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
#Configuration
#EnableWebSecurity
public class SpringSecurityConfiguration extends WebSecurityConfigurerAdapter {
#Override
public void configure(HttpSecurity httpSecurity) throws Exception {
//This allows users to access the "/" and "/Info" endpoints without authenticating with Twitch. To go anywhere else they will have to authenticate.
httpSecurity.antMatcher("/**").authorizeRequests().antMatchers("/", "/Info", "/token/deletion").permitAll().anyRequest().authenticated().and().oauth2Login().and()
//This configures logout tells spring to do the logout with the method in the logoutSuccessHandler
.logout().logoutSuccessUrl("http://localhost:8080/token/deletion").invalidateHttpSession(true).clearAuthentication(true).deleteCookies("JSESSIONID", "JWT");
}
application.properties:
spring.mvc.view.prefix=/WEB-INF/jsp/
spring.mvc.view.suffix=.jsp
spring.security.oauth2.client.registration.twitch=twitch
spring.security.oauth2.client.registration.twitch.client-id=redacted
spring.security.oauth2.client.registration.twitch.client-secret=redacted
spring.security.oauth2.client.registration.twitch.client-authentication-method=post
spring.security.oauth2.client.registration.twitch.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.twitch.redirect-uri=http://localhost:8080/login/oauth2/code/twitch
spring.security.oauth2.client.registration.twitch.scope=user:read:email
spring.security.oauth2.client.registration.twitch.client-name=Twitch
spring.security.oauth2.client.provider.twitch.authorization-uri=https://id.twitch.tv/oauth2/authorize
spring.security.oauth2.client.provider.twitch.token-uri=https://id.twitch.tv/oauth2/token
spring.security.oauth2.client.provider.twitch.jwk-set-uri=https://id.twitch.tv/oauth2/keys
spring.security.oauth2.client.provider.twitch.user-info-uri=https://id.twitch.tv/oauth2/userinfo
spring.security.oauth2.client.provider.twitch.user-info-authentication-method=post
spring.security.oauth2.client.provider.twitch.user-name-attribute=sub
TokenRemovalController:
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.annotation.RegisteredOAuth2AuthorizedClient;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import javax.net.ssl.HttpsURLConnection;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.OutputStream;
import java.net.URL;
import java.nio.charset.StandardCharsets;
#Controller
public class TokenRemovalController {
#RequestMapping("/token/deletion")
public void removeTokenFromTwitch(HttpServletResponse response, #RegisteredOAuth2AuthorizedClient("twitch") OAuth2AuthorizedClient authorizedClient) throws IOException {
//Get access token of current user
String accessToken = authorizedClient.getAccessToken().getTokenValue();
//POST Request to Twitch endpoint
URL url = new URL("https://id.twitch.tv/oauth2/revoke");
HttpsURLConnection https = (HttpsURLConnection)url.openConnection();
https.setRequestMethod("POST");
https.setDoOutput(true);
https.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
String data = "client_id=redacted&token=" + accessToken;
byte[] out = data.getBytes(StandardCharsets.UTF_8);
OutputStream stream = https.getOutputStream();
stream.write(out);
String redirectString = "/error";
if (https.getResponseCode() == 200) {
redirectString = "/Info";
}
https.disconnect();
response.sendRedirect(redirectString);
}
}
Project Structure:
Another thing I forgot to mention was that if I delete all of my browsers cookies then I do get logged out of my site. Is it potentially possible to replicate this effect when users attempt to log out (obviously without deleting all of the users other cookies)?

Spring-security 3.1 single sign on LDAP

I'm trying to add single sign on to two legacy systems on different domains. That currently have working "regular" login.
I found this https://stackoverflow.com/a/9925146 but I'm unsure about the step 1 more specifically this
"implement functionality to serialize and write the Authentication object to a Session cookie with a global scope."
If I understand this correctly I should extract the sessionID and add it to a new cookie with a global scope.
I started by trying to extract the sessionID like so
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.security.web.authentication.WebAuthenticationDetails;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
public class AuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
#Override
public void onAuthenticationSuccess(HttpServletRequest request,
HttpServletResponse response,
Authentication authentication) throws IOException,ServletException {
Cookie cookie = null;
UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;
if (authentication.getDetails() != null) {
WebAuthenticationDetails dets = (WebAuthenticationDetails) auth.getDetails();
System.out.println("sessionID: " + dets.getSessionId());
}
response.addCookie(cookie);
super.onAuthenticationSuccess(request,response,authentication);
}
}
To verify that I'm on the right track i print the sessionID to terminal and compare it to the sessionID that spring-security sets in the browser. If I understand correctly they should match. They don't match. Am I misunderstanding the solution suggested in the answer?

Single sign on is a very difficult problem to get right. I really would not recommend attempting to implement it unless you have a good grasp of the problem and how to solve it. If you can I highly recommend you try to use Oauth2 instead of implementing it yourself.
https://www.baeldung.com/sso-spring-security-oauth2 might give you a starting point.
If you are using an application server like JBoss or WebSphere you may be able to use their SSO option instead.

Spring boot oauth callback for google

I am sharing the complete code regards to my problem.
I am taking the social configuration file handled via social-cfg.xml it is in classpath.
social-cfg.xml
google.client.id=#####################################################################
google.client.secret=############################
google.scope=https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile
I have made java handler to handle this config file
socialConfig.java
package com.inno.config;
import javax.sql.DataSource;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.PropertySource;
import org.springframework.core.env.Environment;
import org.springframework.security.crypto.encrypt.Encryptors;
import org.springframework.social.UserIdSource;
import org.springframework.social.config.annotation.ConnectionFactoryConfigurer;
import org.springframework.social.config.annotation.EnableSocial;
import org.springframework.social.config.annotation.SocialConfigurer;
import org.springframework.social.connect.ConnectionFactoryLocator;
import org.springframework.social.connect.ConnectionRepository;
import org.springframework.social.connect.ConnectionSignUp;
import org.springframework.social.connect.UsersConnectionRepository;
import org.springframework.social.connect.jdbc.JdbcUsersConnectionRepository;
import org.springframework.social.connect.web.ConnectController;
import org.springframework.social.google.connect.GoogleConnectionFactory;
import org.springframework.social.security.AuthenticationNameUserIdSource;
import com.inno.dao.AppUserDAO;
import com.inno.service.ConnectionSignUpImpl;
#Configuration
#EnableSocial
// Load to Environment.
#PropertySource("classpath:social-cfg.properties")
public class SocialConfig implements SocialConfigurer {
private boolean autoSignUp = false;
#Autowired
private DataSource dataSource;
#Autowired
private AppUserDAO appUserDAO;
#Override
public void addConnectionFactories(ConnectionFactoryConfigurer cfConfig, Environment env) {
try {
this.autoSignUp = Boolean.parseBoolean(env.getProperty("social.auto-signup"));
} catch (Exception e) {
this.autoSignUp = false;
}
// Google
GoogleConnectionFactory gfactory = new GoogleConnectionFactory(//
env.getProperty("google.client.id"), //
env.getProperty("google.client.secret"));
gfactory.setScope(env.getProperty("google.scope"));
cfConfig.addConnectionFactory(gfactory);
}
//............. more code regards to another functionality.
when i am hitting this href
<a th:href="#{/auth/google}">Google</a>
<br />
Then it's redirecting to google page with error as below
Error: redirect_uri_mismatch
The redirect URI in the request, http://localhost:8787/auth/google, does not match the ones authorized for the OAuth client. To update the authorized redirect URIs, visit: https://console.developers.google.com/apis/credentials/oauthclient/#######?project=#######
when i visit https://console.developers.google.com/apis/credentials/oauthclient/#######?project=#######
there are two option's
Authorized JavaScript origins
Authorized redirect URIs
I have set both of them to validate with my webapp. I just don't where is the point which stuck out this issue. PLease help me out. Also ask for any other requirement if required.

redirect URI in the google developer console must exactly match where you are sending your request from. In your case the error message tells you exactly where you are sending your request form.
http://localhost:8787/auth/google
Which means that you need to have that exactly in the Google developer console under Authorized redirect URIs or the authentication sever will not accept your request.
Note Port must be included. Exactly means exactly with the exception of cased.

New web service methods not being mapped on a tomcat instance on Azure

I have a web service running on tomcat 8.5, however whenever I try to update the version, the new methods do not map properly, and 404 as a result.
For example, if a prior version had a method such as host/ContextPath/HelloWorld/, that'd run completely fine, no issues there.
However if I were to add a new method, host/ContextPath/AnotherMethod/, this method would 404.
It's not a case of the newer versions aren't being run on Azure, as you can look at the deployment history and see that it's pulling the latest versions from github, and apparently deploys them successfully.
I am unsure of how to progress from here, as what I have should be working, eg the new versions are on the server, server is running and healthy etc, yet it isn't.
Additionally, by viewing what files are on the server through site\wwwroot[project files], I can actually see that the most up to date versions of the files are on the server.
However, the methods are not being exposed, so I am at a loss as to what is happening.
For example, consider the AdministrationService, which you can see the code for below:
package services;
import controllers.DatabaseController;
import controllers.EmailController;
import controllers.ProgrammeController;
import entities.Programme;
import java.io.InputStream;
import javax.json.Json;
import javax.json.JsonArray;
import javax.json.JsonException;
import javax.json.JsonObject;
import javax.json.JsonReader;
import javax.ws.rs.Consumes;
import javax.ws.rs.GET;
import static javax.ws.rs.HttpMethod.POST;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.QueryParam;
import javax.ws.rs.core.MediaType;
import utilities.SQLQuery;
#Path("/Admin")
public class AdministrationService {
ProgrammeController pc = new ProgrammeController();
/**
* A simple method for testing if our service is online.
* -> GET /API/Admin/Health
* If true is returned, we will have configured our service properly.
* #return
*/
#GET
#Path("/Health")
public Boolean getHealthy(){
return true;
}
#GET
#Path("/TestEmail")
public void testEmail(#QueryParam("target")String target){
EmailController ec = EmailController.getInstance();
String messageBody = "Hello world";
String recipient = target;
String messageSubject = "Test email";
ec.sendEmail(recipient, messageBody, messageSubject);
}
}
The /Health method is an old method. It runs just fine if I access it through
myazurehost.net/ContextPath/Admin/Health
However if I attempt to do the same with
myazurehost.net/ContextPath/Admin/TestEmail?target=testemail#gmail.com
I receive a 404 error. It's not a case of the method being incorrectly called, as the error is a 404, not a 400 bad request, 405 wrong type etc. As far as the server is concerned, the method does not exist and it's baffling.
I've tried server reboots, reinitialising the project, to no avail. Any help is greatly appreciated.

RESTful services on AEM

I am trying to expose some RESTfull webservices on AEM. I have followed the instructions in this blog. Below is my service class. Simple requests like /helloservice/sayhi works perfectly, but the method that take path parameter and query parameters (/withparameter/{userid} and /query?q=xyz&prod=abc) return 404 error page. Please help me with this.
I am using AEM 5.6 and Java 7
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.QueryParam;
import javax.ws.rs.core.MediaType;
import org.apache.felix.scr.annotations.Component;
import org.apache.felix.scr.annotations.Service;
import com.foo.bar.service.SampleResource;
#Service
#Component(metatype=true)
#Path("/helloservice")
public class SampleResourceImpl implements SampleResource{
#GET
#Path("/sayhi")
#Produces({MediaType.APPLICATION_JSON})
public String helloWorld(){
return "Hello World";
}
#GET
#Path("/getoperation")
#Produces({MediaType.TEXT_PLAIN})
public String getServiceOperation(){
return "Hello getoperation!";
}
#GET
#Path("/withparameter/{userid}")
#Produces({MediaType.TEXT_PLAIN})
public String getWithParameter(#PathParam("userid") String userid){
return "Path parameter : "+userid;
}
#GET
#Path("/query")
#Produces({MediaType.TEXT_PLAIN})
public String getURLParameters(#QueryParam("q") String q, #QueryParam("prod") String prod){
return "Query params : "+q+", "+prod;
}
}
Any help appreciated, Thanks!

There's an ongoing discussion about using JAX-RS in systems based on Apache Sling (which includes AEM) at https://issues.apache.org/jira/browse/SLING-2192 . From that discussion, https://github.com/wcm-io-caravan/caravan-jaxrs looks to me like a good solution to use JAX-RS resources in an OSGi environment. That project's integration tests run on Sling so there's a fair chance that it works on AEM.

This is wrong usage of Sling architecture.
If you want to implement some RESTful service (querying by path, etc) you need to implement specific resource provider.
There is an example. You may need to understand some basic concepts behind it but still its 10 times better in Sling's world than JAX-RS.

Cognifide has implemented alternative solution which is called Knot.X.
It allows to easly write micro services (and rest APIs). It was written for AEM, but it can be used with any CMS/CRM.
Informations, code examples and docs can be found here: http://knotx.io/

I passed the parameters as querystring, then with "UriInfo" from javax.ws.rs.core worked for me:
#GET
#Path("/data")
#Produces({MediaType.APPLICATION_JSON})
public JSONArray getData(#Context UriInfo info) throws JSONException {
String path = info.getQueryParameters().getFirst("p");
String nodename = info.getQueryParameters().getFirst("nn");

Some paths and methods of requests are blocked by default on AEM. Go to "Apache Sling Servlet/Script Resolver and Error Handler" on config to allow this /services and go to "Apache Sling Referrer Filter" to remove blocked HTTP methods.