Spring Security OAuth2 check_token endpoint

spring spring-security oauth-2.0 spring-security-oauth2
sowdri picture sowdri · Nov 5, 2014 · Viewed 32.4k times · Source

I'm trying to setup a resource server to work with separate authorization server using spring security oauth. I'm using RemoteTokenServices which requires /check_token endpoint.

I could see that /oauth/check_token endpoint is enabled by default when @EnableAuthorizationServer is used. However the endpoint is not accessible by default.

Should the following entry be added manually to whitelist this endpoint?

http.authorizeRequests().antMatchers("/oauth/check_token").permitAll();

This will make this endpoint accessible to all, is this the desired behavior? Or am I missing something.

Thanks in advance,

Answer

Pratik Shah picture Pratik Shah · Nov 6, 2014

You have to 

@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception
{
   oauthServer.checkTokenAccess("permitAll()");    
}

For more information on this ::

How to use RemoteTokenService?

Related questions

Request new access token using refresh token in username-password grant in Spring Security OAuth2

We're using the username-password grant to obtain an access token from our auth server. We want to refresh the access token before it expires using the provided refresh token until the user logs out or closes the client app. However …

Read More
Using scopes as roles in Spring Security OAuth2 (provider)

Let's consider a fairly simple hypothetical application where users can read or write posts. Some users can read and write articles while some others can only read them. With Spring Security (3.2.1) I modeled this by having 2 roles: ROLE_WRITE: this …

Read More
Real Time examples for Oauth2 Grant Types and Good document, example for Oauth2 with Spring MVC

I've read about Oauth2 few days before, it has entities like Client, Resource Owner, Resource Server, Authorization Server and i understood the explanations too. but i don't understand the grant type's completely still i got confusion on following types. Oauth2 …

Read More