├── README.md
└── SpringRestSecurityOauth
├── .classpath
├── .project
├── .settings
├── org.eclipse.jdt.core.prefs
├── org.eclipse.wst.common.component
└── org.eclipse.wst.common.project.facet.core.xml
├── pom.xml
├── src
└── main
│ ├── java
│ └── com
│ │ └── beingjavaguys
│ │ ├── controllers
│ │ └── RestController.java
│ │ ├── models
│ │ └── User.java
│ │ └── services
│ │ ├── DataService.java
│ │ └── DataServiceImpl.java
│ └── webapp
│ ├── WEB-INF
│ ├── mvc-dispatcher-servlet.xml
│ ├── spring-security.xml
│ └── web.xml
│ └── index.jsp
└── target
└── classes
└── com
└── beingjavaguys
├── controllers
└── RestController.class
├── models
└── User.class
└── services
├── DataService.class
└── DataServiceImpl.class
/README.md:
--------------------------------------------------------------------------------
1 | ## Updated Version avilable here: https://www.codeburps.com/post/spring-boot-oauth2-for-server-to-server-security
2 |
3 |
4 |
5 | #### Securing Restful Web Services with Spring Security and OAuth2
6 |
7 | The flow of application will go something like this:
8 |
9 | ##### 1) User sends a GET request to server with five parameters: grant_type, username, password, client_id, client_secret; something like this
10 |
11 | http://localhost:8080/SpringRestSecurityOauth/oauth/token?grant_type=password&client_id=restapp&client_secret=restapp&username=beingjavaguys&password=spring@java
12 |
13 | ##### 2) Server validates the user with help of spring security, and if the user is authenticated, OAuth generates a access token and send sends back to user in following format.
14 | ```
15 | {
16 | "access_token": "22cb0d50-5bb9-463d-8c4a-8ddd680f553f",
17 | "token_type": "bearer",
18 | "refresh_token": "7ac7940a-d29d-4a4c-9a47-25a2167c8c49",
19 | "expires_in": 119
20 | }
21 | ```
22 | Here we got access_token for further communication with server or to get some protected resourses(API’s), it mentioned a expires_in time that indicates the validation time of the token and a refresh_token that is being used to get a new token when token is expired.
23 |
24 | ##### 3) We access protected resources by passing this access token as a parameter, the request goes something like this:
25 |
26 | http://localhost:8080/SpringRestSecurityOauth/api/users/?access_token=8c191a0f-ebe8-42cb-bc18-8e80f2c4238e
27 |
28 | Here http://localhost:8080/SpringRestSecurityOauth is the server path, and /api/users/ Is an API URL that returns a list of users and is being protected to be accessed.
29 |
30 | ##### 4) If the token is not expired and is a valid token, the requested resources will be returned.
31 |
32 | ##### 5) In case the token is expired, user needs to get a new token using its refreshing token that was accepted in step(2). A new access token request after expiration looks something like this:
33 |
34 | http://localhost:8080/SpringRestSecurityOauth/oauth/token?grant_type=refresh_token&client_id=restapp&client_secret=restapp&refresh_token=7ac7940a-d29d-4a4c-9a47-25a2167c8c49
35 |
36 | And you will get a new access token along with a new refresh token.
37 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/.classpath:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/.project:
--------------------------------------------------------------------------------
1 |
2 |
3 | SpringRestSecurityOauth
4 | NO_M2ECLIPSE_SUPPORT: Project files created with the maven-eclipse-plugin are not supported in M2Eclipse.
5 |
6 |
7 |
8 | org.eclipse.jdt.core.javabuilder
9 |
10 |
11 | org.eclipse.wst.common.project.facet.core.builder
12 |
13 |
14 | org.eclipse.wst.validation.validationbuilder
15 |
16 |
17 |
18 | org.eclipse.wst.common.project.facet.core.nature
19 | org.eclipse.jdt.core.javanature
20 | org.eclipse.wst.common.modulecore.ModuleCoreNature
21 | org.eclipse.jem.workbench.JavaEMFNature
22 |
23 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/.settings/org.eclipse.jdt.core.prefs:
--------------------------------------------------------------------------------
1 | #Wed Oct 15 13:56:41 IST 2014
2 | org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7
3 | eclipse.preferences.version=1
4 | org.eclipse.jdt.core.compiler.source=1.7
5 | org.eclipse.jdt.core.compiler.compliance=1.7
6 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/.settings/org.eclipse.wst.common.component:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 | uses
8 |
9 |
10 | uses
11 |
12 |
13 | uses
14 |
15 |
16 | uses
17 |
18 |
19 | uses
20 |
21 |
22 | uses
23 |
24 |
25 | uses
26 |
27 |
28 | uses
29 |
30 |
31 | uses
32 |
33 |
34 | uses
35 |
36 |
37 | uses
38 |
39 |
40 | uses
41 |
42 |
43 | uses
44 |
45 |
46 | uses
47 |
48 |
49 | uses
50 |
51 |
52 | uses
53 |
54 |
55 | uses
56 |
57 |
58 | uses
59 |
60 |
61 | uses
62 |
63 |
64 | uses
65 |
66 |
67 | uses
68 |
69 |
70 |
71 |
72 |
73 |
74 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/.settings/org.eclipse.wst.common.project.facet.core.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/pom.xml:
--------------------------------------------------------------------------------
1 |
3 | 4.0.0
4 | com.beingjavaguys.sample
5 | SpringRestSecurityOauth
6 | war
7 | 1.0-SNAPSHOT
8 | SpringRestSecurityOauth Maven Webapp
9 | http://maven.apache.org
10 |
11 |
12 | 4.0.7.RELEASE
13 | 1.2.17
14 | 1.7
15 | SpringRestSecurityOauth
16 | 3.2.5.RELEASE
17 |
18 |
19 | ${pom.artifactId}
20 |
21 |
22 | maven-compiler-plugin
23 |
24 | ${jdk.version}
25 | ${jdk.version}
26 |
27 |
28 |
29 |
30 |
31 |
32 |
33 | org.apache.commons
34 | commons-io
35 | 1.3.2
36 |
37 |
38 |
39 |
40 | log4j
41 | log4j
42 | ${log4j.version}
43 |
44 |
45 |
46 |
47 | org.springframework
48 | spring-web
49 | ${spring.version}
50 |
51 |
52 | org.springframework
53 | spring-webmvc
54 | ${spring.version}
55 |
56 |
57 |
58 |
59 | org.springframework.security
60 | spring-security-web
61 | ${spring.security.version}
62 |
63 |
64 | org.springframework.security
65 | spring-security-config
66 | ${spring.security.version}
67 |
68 |
69 | org.springframework.security.oauth
70 | spring-security-oauth2
71 | 1.0.0.RELEASE
72 |
73 |
74 | com.google.code.gson
75 | gson
76 | 2.2.2
77 |
78 |
79 | org.codehaus.jackson
80 | jackson-mapper-asl
81 | 1.9.10
82 |
83 |
84 | commons-httpclient
85 | commons-httpclient
86 | 3.1
87 |
88 |
89 | org.springframework
90 | spring-context-support
91 | ${spring.version}
92 |
93 |
94 | javax.servlet
95 | javax.servlet-api
96 | 3.0.1
97 | provided
98 |
99 |
100 |
101 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/src/main/java/com/beingjavaguys/controllers/RestController.java:
--------------------------------------------------------------------------------
1 | package com.beingjavaguys.controllers;
2 |
3 | import java.util.List;
4 |
5 | import org.springframework.beans.factory.annotation.Autowired;
6 | import org.springframework.stereotype.Controller;
7 | import org.springframework.web.bind.annotation.RequestMapping;
8 | import org.springframework.web.bind.annotation.RequestMethod;
9 | import org.springframework.web.bind.annotation.ResponseBody;
10 |
11 | import com.beingjavaguys.models.User;
12 | import com.beingjavaguys.services.DataService;
13 |
14 | /**
15 | * @author Nagesh.Chauhan
16 | *
17 | */
18 | @Controller
19 | @RequestMapping("/api/users")
20 | public class RestController {
21 |
22 | @Autowired
23 | DataService dataService;
24 |
25 | @RequestMapping(value = "/", method = RequestMethod.GET)
26 | @ResponseBody
27 | public List list() {
28 | return dataService.getUserList();
29 |
30 | }
31 | }
32 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/src/main/java/com/beingjavaguys/models/User.java:
--------------------------------------------------------------------------------
1 | package com.beingjavaguys.models;
2 | /**
3 | * @author Nagesh.Chauhan
4 | *
5 | */
6 | public class User {
7 | private int id;
8 | private String name;
9 | private String email;
10 | private String phone;
11 |
12 | public User() {
13 | super();
14 | // TODO Auto-generated constructor stub
15 | }
16 |
17 | public User(int id, String name, String email, String phone) {
18 | super();
19 | this.id = id;
20 | this.name = name;
21 | this.email = email;
22 | this.phone = phone;
23 | }
24 |
25 | public int getId() {
26 | return id;
27 | }
28 |
29 | public void setId(int id) {
30 | this.id = id;
31 | }
32 |
33 | public String getName() {
34 | return name;
35 | }
36 |
37 | public void setName(String name) {
38 | this.name = name;
39 | }
40 |
41 | public String getEmail() {
42 | return email;
43 | }
44 |
45 | public void setEmail(String email) {
46 | this.email = email;
47 | }
48 |
49 | public String getPhone() {
50 | return phone;
51 | }
52 |
53 | public void setPhone(String phone) {
54 | this.phone = phone;
55 | }
56 |
57 | }
58 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/src/main/java/com/beingjavaguys/services/DataService.java:
--------------------------------------------------------------------------------
1 | package com.beingjavaguys.services;
2 |
3 | import java.util.List;
4 |
5 | import com.beingjavaguys.models.User;
6 | /**
7 | * @author Nagesh.Chauhan
8 | *
9 | */
10 | public interface DataService {
11 | public List getUserList();
12 | }
13 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/src/main/java/com/beingjavaguys/services/DataServiceImpl.java:
--------------------------------------------------------------------------------
1 | package com.beingjavaguys.services;
2 |
3 | import java.util.ArrayList;
4 | import java.util.List;
5 |
6 | import org.springframework.stereotype.Service;
7 |
8 | import com.beingjavaguys.models.User;
9 | /**
10 | * @author Nagesh.Chauhan
11 | *
12 | */
13 | @Service
14 | public class DataServiceImpl implements DataService {
15 |
16 | @Override
17 | public List getUserList() {
18 |
19 | // preparing user list with few hard coded values
20 | List userList = new ArrayList();
21 |
22 | userList.add(new User(1, "user_a", "user_a@example.com", "9898989898"));
23 | userList.add(new User(2, "user_b", "user_b@example.com", "9767989898"));
24 | userList.add(new User(3, "user_c", "user_c@example.com", "9898459898"));
25 |
26 | return userList;
27 | }
28 |
29 | }
30 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/src/main/webapp/WEB-INF/mvc-dispatcher-servlet.xml:
--------------------------------------------------------------------------------
1 |
2 |
9 |
10 |
11 |
12 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/src/main/webapp/WEB-INF/spring-security.xml:
--------------------------------------------------------------------------------
1 |
2 |
11 |
12 |
13 |
14 |
17 |
18 |
19 |
20 |
22 |
24 |
25 |
26 |
27 |
29 |
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
42 |
43 |
44 |
45 |
47 |
48 |
49 |
50 |
51 |
53 |
54 |
56 |
57 |
58 |
59 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
72 |
73 |
74 |
75 |
76 |
79 |
81 |
82 |
83 |
84 |
85 |
86 |
87 |
88 |
90 |
91 |
92 |
93 |
94 |
96 |
98 |
99 |
101 |
103 |
104 |
105 |
106 |
107 |
108 |
109 |
111 |
112 |
113 |
114 |
117 |
118 |
119 |
120 |
121 |
122 |
123 |
124 |
126 |
127 |
128 |
129 |
132 |
133 |
136 |
137 |
138 |
139 |
141 |
143 |
144 |
145 |
146 |
147 |
148 |
149 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/src/main/webapp/WEB-INF/web.xml:
--------------------------------------------------------------------------------
1 |
5 |
6 | Sample Spring Maven Project
7 |
8 |
9 |
10 | mvc-dispatcher
11 | org.springframework.web.servlet.DispatcherServlet
12 | 1
13 |
14 |
15 | mvc-dispatcher
16 | /
17 |
18 |
19 | org.springframework.web.context.ContextLoaderListener
20 |
21 |
22 |
23 | contextConfigLocation
24 |
25 | /WEB-INF/mvc-dispatcher-servlet.xml,
26 | /WEB-INF/spring-security.xml
27 |
28 |
29 |
30 |
31 |
32 |
33 | springSecurityFilterChain
34 | org.springframework.web.filter.DelegatingFilterProxy
35 |
36 |
37 |
38 | springSecurityFilterChain
39 | /*
40 |
41 |
42 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/src/main/webapp/index.jsp:
--------------------------------------------------------------------------------
1 |
2 |
3 | Hello World!
4 |
5 |
6 |
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/target/classes/com/beingjavaguys/controllers/RestController.class:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nkchauhan003/SpringSecurityOAuth2/e79961734b03c453516b1c8c12cc8a5a7a035abb/SpringRestSecurityOauth/target/classes/com/beingjavaguys/controllers/RestController.class
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/target/classes/com/beingjavaguys/models/User.class:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nkchauhan003/SpringSecurityOAuth2/e79961734b03c453516b1c8c12cc8a5a7a035abb/SpringRestSecurityOauth/target/classes/com/beingjavaguys/models/User.class
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/target/classes/com/beingjavaguys/services/DataService.class:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nkchauhan003/SpringSecurityOAuth2/e79961734b03c453516b1c8c12cc8a5a7a035abb/SpringRestSecurityOauth/target/classes/com/beingjavaguys/services/DataService.class
--------------------------------------------------------------------------------
/SpringRestSecurityOauth/target/classes/com/beingjavaguys/services/DataServiceImpl.class:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nkchauhan003/SpringSecurityOAuth2/e79961734b03c453516b1c8c12cc8a5a7a035abb/SpringRestSecurityOauth/target/classes/com/beingjavaguys/services/DataServiceImpl.class
--------------------------------------------------------------------------------