I am currently implementing Shiro-Authentication along with OAuth for Google SignIn. It all works great and lets me authenticate a gmail account against a users email in my database.
My build config looks as follows:
//User roles and permissions
compile (":shiro:1.2.0") {
excludes "servlet-api"
excludes "shiro-quartz"
}
//Google SignIn
compile ":oauth:2.1.0"
The only issue I am having is that when google requests permission for my application, I get this:
When I was expecting something more like this:
It is clearly still using OAuth 1.0 and not 2.0.
I have read many questions on here and the closest I have found is this Google consent screen not shown as expected .
The only issue with this implementation is that it uses Spring security and I am using Shiro. When I try use the spring plugin, I keep coming up against this issue when I try to compile it:
| Error The following artifacts could not be resolved: org.springframework.security:spring-security-core:jar:3.2.0.RC1, org.springframework.security:spring-security-web:jar:3.2.0.RC1: Could not find artifact org.springframework.security:spring-security-core:jar:3.2.0.RC1 in grailsCentral (http://repo.grails.org/grails/plugins)
| Run 'grails dependency-report' for further information.
IDEA hook: Grails not found!
| Error java.lang.NullPointerException
| Error at org.jetbrains.groovy.grails.rt.Agent$2.run(Agent.java:135)
| Error at java.lang.Thread.run(Thread.java:695)
Any tips or suggestions are greatly appreciated.
Cheers.
I have create a sample grails application that uses oauth plugin for google authentication with oauth2.
Have a try.
I have created a new java file in src/java as suggested here, and using this in my google configurations in Config.groovy.
I have provided the full solution here.
Related
I have been delevopping and deploying a python application for the SAP Cloud Foundry and trying to implement an authentication check using OAuth2.0.
Using this Tutorial.
Link to Code Note: I excluded the node_modules/#sap/approuter for storage reasons
When I open https://cproPythonAI_web.cfapps.us10.hana.ondemand.com the login site is loaded correctly, but after the login I get to a Error-Site.
Kind regards and thanks for help
Nick
did every step of the tutorial
entered "authenticationMethod": "none" to the xs-app.json. Then i get redirect to the index.html, but of course the authentification is skipped
To write custom federation , after generating jar using pom from wso2 docs , i put that in said folder . but how do use this custom federation , Documentation stops after this .
I cant see my new custom federation name in any drop down , i was expecting to see this in the list of federation drop down in Service Provider configuration
If we write custom federation for Oauth IDP , all the urls configuration have to be programatically managed in OSGI bundle, we wont get UI for that ?
Why is OAuth not supported if we have any other vendor apart from facebook and google, yahoo, which is not openid connect we cant use any out of the box SSO .
i got my Bundle loaded on to WSO2 these were the steps
i started wso2 with osgi console
$>wso2Server.bat -DosgiConsole
After this server starts and if we hit enter we can get osgi prompt
there we can type osgi commands
try $> package org.abc.whateverpackage
this will list all the bundles that import/export the given package name within the runtime.
try to $install file:<filepath> this gives an error message saying something is missing in imnport or whatever issue might be
im my case i started with pom from wso2 so i had to correct the configuration
from org.wso2.carbon.identity.application.authentication.framework.*,
to org.wso2.carbon.identity.application.authentication.framework.*;version="4.2.2"
the number 4.2.2 i got from the dependencies in the pom
i added BundleActivator
<Bundle-Activator>com.osgi.customauth.Activator</Bundle-Activator>
Now when i create an IDP i can see my custom Authenticator in the list along with google , yahoo etc
But all the urls for OAUTH are in my code i have to programatically externalize this , i did not yet find a clean way to do this
Where can I find an basic applicationContext.xml configuration of an OAuth2 Client for Authorization Code grant type using spring-security-oauth2 version 2.0.x ?
There's a sample in the integration tests: https://github.com/spring-projects/spring-security-oauth/blob/master/tests/xml/client/src/main/resources/context.xml. The old 1.0.* XML should work with 2.0.* as well, so just look at the tonr2 sample in the 1.0.x branch.
Is there any example out there for google plus oAuth2 for grails?
I see a plugin on github with documentation
This one seems to be 2 years old and I could not find any examples of using this plugin.
I am willing to try this. but want to know if there are any other plugins out there which are up-to-date?
I have had success using this one: http://grails.org/plugin/spring-security-oauth-google, but it requires the use of the Spring Security Oauth Plugin: http://grails.org/plugin/spring-security-oauth
I am working with an app that uses spring-security 3.0 and oauth2 using spring-security-oauth-1.0.0.M3. It works fine. But it looks like migrating to spring-security 3.1 will not be trivial. I have been unable to find confirmation that the oauth module is still supported.
For example, the oauth tutorial mentions 3.0 not 3.1:
https://github.com/SpringSource/spring-security-oauth/wiki/tutorial
And I have encountered a problem similar to the Mar 4, 2012 comment in the following discussion when I attempt to do a straight upgrade to 3.1 using spring-security-oauth 1.0.0.M3 or M4:
http://code.google.com/p/spring-security-social/wiki/Usage
Specifically I see this in the Tomcat logs:
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration
problem: Failed to import bean definitions from URL location ...
Offending resource: class path resource [spring/applicationContext.xml]; nested
exception is org.springframework.beans.factory.BeanDefinitionStoreException: Unexpected
exception parsing XML document from URL ...; nested exception is
org.springframework.beans.FatalBeanException: Invalid NamespaceHandler class
[org.springframework.security.oauth2.config.OAuth2SecurityNamespaceHandler] for namespace
[http://www.springframework.org/schema/security/oauth2]: problem with handler class file or
dependent class; nested exception is java.lang.NoClassDefFoundError:
org/springframework/security/web/util/AntUrlPathMatcher
Can someone suggest a solution to the above problem, or point to a reference for using spring-security 3.1 and spring-security-oauth, or else suggest a better alternative to implement oauth2 using spring-security 3.1?
Or if I'm missing a fundamental point of spring-security 3.1, that would also be useful to know.
Thanks!
Yes, Spring Security OAuth milestone build 1.0.0.M6, and specifically the oauth2 module, supports Spring Security 3.1.0. It is not yet considered a release. The OAuth 2.0 spec itself is not final.
The 1.0.0.M6 samples appear to be the most accurate and complete reference for implementation. The full 1.0.0.M6 tag zipball is here.
The OAuth 2 Developers Guide is a good textual reference. It's not 100% accurate, at least with respect to 1.0.0.M6. For example, the attribute user-approval-page belongs to authorization-server not authorization-code.
The Maven pom.xml must refer to artifactId spring-security-oauth2 (not spring-security-oauth as in older versions such as 1.0.0.M3).