I am trying to make spring security with oauth2 work but there is really no good tutorial out there. The tonr and sparkl example apps magically work but I won't have a spring client which maybe does some magic. So does anyone have a valid spring3 oauth2 config and/or tutorial plus the client config?
Thanx!
Related
This question may look like work flow requirement but I would like to get advice about both workflow as well as implementation part of JWT based REST service in spring Boot with spring social APIs integrated with it.
I have a working code base, which works fine with custom JWT token implementation. I find it difficult to integrate spring social APIs along with it. Any help would be really appreciated.
Thanks in Advance.
How to secure REST services (OAuth) with Spring Boot?
The closest I can get is:
http://spring.io/guides/gs/securing-web/
http://spring.io/guides/gs/authenticating-ldap/
You could add the OAuth2AuthenticationProcessingFilter pretty easily to a Boot app. The closest sample would probably be the spring-boot-sample-secure, since it explicitly adds a WebSecurityConfigurerAdapter, which is what you'd have to do. There is no native autoconfiguration support for OAuth in Spring Boot yet (but please feel free to add it). It is on the roadmap, but unlikely to get a lot of attention unless more people ask for it.
Does anyone over here has experience integrating TAM with Grails spring security for single sign on. If so can you help me get a quick start or point to any tutorials.
Thanks
You would probably want to use Spring Security's pre authentication feature and examine the header sent from TAM. To do so you would write your own authentication provider which is really simple and just looks for the header. See this for some more information
I am developing an API in Ruby on Rails 3 and I would like to secure it with Oauth2.
In other words, I need to create an Oauth provider. Is there a working gem for Rails 3 out there or perhaps a tutorial on the issue?
UPDATE
I know Rails are REST based so I find it very strange that there are no tutorials on how to create a public API and secure it. Does anyone know of any good tutorials. Preferable with oAuth.
Thankful for all help!!
Check out this gem https://github.com/applicake/doorkeeper
It is for Rails 3, the development it's early stages though.
There's also an example app that you take a look and see how the API is done.
http://doorkeeper-provider.herokuapp.com/
I've opensourced an OAuth2 server implementation yesterday.
It's well documented and there is a dashboard to control accesses. Right now I'm searching for somebody who wants to build an engine starting from it, or something cool on top of rack. That's why it is open-source.
https://github.com/intridea/oauth2 is the canonical gem right now for OAuth2 dev. If you are looking for a more complete solution, instead of rolling your own provider code, check out:
https://github.com/songkick/oauth2-provider
https://github.com/freerange/oauth2-provider
But I suggest messing around with the oauth2 gem if you aren't very familiar with the flow so that you can learn it better.
If you are using (or planning to use) devise for authentication, you can use https://github.com/socialcast/devise_oauth2_providable as plugin.
I'm developing a rugygem for OAuth2 provider, Rack::OAuth2.
https://github.com/nov/rack-oauth2
It requires to develop models (token, code, client etc) by yourself, but you can get a whole Rails3 sample OAuth2 server here.
https://github.com/nov/rack-oauth2-sample
I'm looking to implement an OAuth2 provider, too! I'm currently experimenting with this https://github.com/assaf/rack-oauth2-server, which seems to be a full-featured OAuth2 server, though it still supports only MongoDB, although implementing support for other DBMS seems simple enough. I am also looking at some of the other options posted here, lots of promising stuff!
"Doorkeeper is a gem that makes it easy to introduce OAuth 2 provider functionality to your application."
https://github.com/applicake/doorkeeper
I cannot find a complete example anywhere of a Spring Security Web App with Open Id registration similar to stackoverflows.
I would say I'm pretty techy guy but I find Spring Security extremely intimidating with its weird Spring XML DSL.
I have found bits and pieces of how one would do the good ole' stackoverflow registration using:
Spring Security Open ID sample WAR
Hillerts Blog 3 part blog posting
Spring Security Official Doc on OpenId (the email attributes are wrong see next link)
Stackoverflow posting about email attributes
JQuery OpenId library for picking your OpenId provider Stackoverflow has a modified one that seems to include Facebook
Best Article on the subject but a little long winded
Another example like previous one for Google App Engine
But no complete examples (WAR). Does anyone know or have a working example (ie WAR) that does more than just authenticate with an in-memory openid urls?
UPDATE: The latest version of Spring Social does a very good job of managing Oauth registration. We ended up using it instead. Although its not OpenId I have grown to prefer Oauth over OpenId. For those interested in there is a project to use OpenId with spring social: https://github.com/molindo/spring-social-openid
Have you looked at the latest version of the sample code (for the 3.1 release)?
It has several improvements to make it simpler to use Google and Yahoo authentication together (with different attribute exchange configurations simultaneously), uses a similar login dialog to stack overflow and performs simple registration in the case of users who have not previously accessed the app.
See this issue https://jira.springsource.org/browse/SEC-1431 (and the linked one) for more information.
I know this is not really helpful in answering your Question but I am currently building a Grails based web application and initailly started using Spring Security but also found it difficult to setup.
I then changed to Apache Shiro and it is much simpler to implement. But it doesn't have support for openid out of the box, but the nimble grails plugin does so you may be able to use that as an example to write your own.
Yes,
There is a war to download on http://repo1.maven.org/maven2/org/springframework/security/spring-security-samples-openid/3.0.1.RELEASE/
Maybe it can help you.
It's not exactly OpenID, it uses Facebook Connect, but checkout Spring's GreenHouse. That's great code written by the guys from Spring you can use to jumpstart your app.
Yes, In spring application, user can authenticate into your application with open ID provider.
1) Here is the sample example of spring open ID login application.
2) Here is the sample example of spring security social login application and blog here.