Spring OAUTH2 for an angular web applciation - oauth-2.0

Question

I'm trying to implements OAUTH2 for a web applciation and need a simple OAUTH2 setup to secure rest APIs. One of the rest APIs provides login functionality where in it validates user credentails(username/password). My usecase is as follows:
1. Client for APIs is AngularJS for now but there might be other clients in the future
2.Users to login into the application with username and password i.e. UI layer (angular) to call login rest service and on successful authentication generate access token with an expiry time.
3. Clients to use this generated access token to consume other APIs in the application
Please suggest a simple OAUTH2 configuration for the above usecase?

Answer 1

Spring OAuth2 come with build-in endpoint to obtain an access_token via API with Resource Owner Password Grant
Here is an simple configuration for you
#Configuration
public class OAuth2ServerConfiguration {
private static final String RESOURCE_ID = "tonywebapp-restservice";
#Configuration
#EnableAuthorizationServer
protected static class AuthorizationServerConfiguration extends
AuthorizationServerConfigurerAdapter {
#Autowired
#Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;
#Autowired
private UserApprovalHandler userApprovalHandler;
#Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints)
throws Exception {
endpoints
.tokenStore(tokenStore())
.userApprovalHandler(userApprovalHandler)
.authenticationManager(authenticationManager)
.pathMapping("/oauth/error", "/oauth/error.html")
.pathMapping("/oauth/confirm_access", "/oauth/confirm_access.html")
;
}
#Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients
.inMemory()
.withClient("your_client_id_here")
.resourceIds(RESOURCE_ID)
.authorizedGrantTypes("password", "refresh_token")
.authorities("USER")
.scopes("read.some.thing", "write.some.thing", "any.thing.you.want")
.resourceIds(RESOURCE_ID)
.secret("your_secret_here");
}
#Bean
#Primary
public DefaultTokenServices tokenServices() {
DefaultTokenServices tokenServices = new DefaultTokenServices();
tokenServices.setSupportRefreshToken(true);
tokenServices.setTokenStore(tokenStore ());
return tokenServices;
}
#Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
}
}
But, it's recommendation that not using this grant for web base apps. Because you cannot protec your secret. I'm using implicit grant type for my AngularJS web apps.