Spring Boot 3 Tutorial Security OAuth2 Spring Authorization Server Custom Password Grant type

Spring Boot 3.0.2 Tutorial - Security - OAuth 2.0 Custom Password Grant Type

Part 1
Spring Authorization Server
Custom Password Grant Type

© 2022 Willy De Keyser, All Rights Reserved.

[hoangtushu]

Hi Willy... once again thanks!!! Thanks a lot!!!... This set of videos helped me to accomplish a very important project!

[YuliAnto-jqqq]

Hi Sir, I have implementation this tutorial together with JPA implementation but having issue when call refresh token on the its return user null, how to solve that issue Sir? Thanks a lot

[dhirajkumar]

Hi Willy.. Thank you for this video.
I am getting one issue regarding @PreAuthorized.
If I am putting read or write it works fine but for custom roles (ADMIN, USER), it throws error 500.
Can you please help with this?

[RahulBake-hb]

Hi Willy, Thanks for the video can we authenticate with username and password only instead of client secret in custom password grant type

[priyanka-jjvv]

How to access /introspect with this code, and what params need to be passed

[mrab.a]

I tried consuming the token to API in the authorization-server service, the result was unauthorized, is it not possible to consume tokens in the authorization-server service ?

[dzMike]

Do you know how we can customise the content of the refresh token in the same way as we do for the access token? I can see in your example that the tokenCustomizer function is called to add things to the access token but this is not the case for the refresh token which always seems to be an empty object {} when decoded. Thanks so much for your help!

[dzMike]

Thanks again. You wouldn't happen to know how to customize the response for e.g. the /token endpoint? So that instead of returning this:
{
"access_token": "ABCD etc",
"refresh_token": "DEFG etc",
"token_type": "Bearer",
"expires_in": 86399
}

I can change that JSON to whatever I like?

[El_Phill]

good tutorial but damn, it looks extremely overwhelming and complicated

[paulcalinovici]

In the AuthenticationConverter the clientPrincipal is taken from the SecurityContext but I haven't seen anywhere where the clientId and secret are checked and the SecurityContext set. Is this done by an internal filter of spring oauth2 default configuration?

[ronitmacwan]

I always got anonymous user from bearer token in security context can you please help?

[fredzouza]

Great video thanks, but i have a question, how implement logout/revoke on this code ?

[ChaitanyaJadhav-we]

great video !!, could you please tell how other grant types will work as now only grant type "custom_password" is working.

[subeshvasu]

Hi Sir, I have implemented custom password grant type as per this video, Please provide me a reference link and code implementation, where Spring cloud gateway validates JWT token with oauth2 Authorization server.

[yebadokpogodson]

Hello, thank you for this video. I was able to configure the custom password and get it token but since that i'm not able to get token with grant type authorization_code anymore. do you have any idea how to adapt the token generator to both custom password and authorization_code ?

[amitrathi-ness]

good content and very informative video, thanks for the post

[quoctuong]

Thanks lots for the interesting tutorial

[burakbalm]

Hi sir, I'm gettiing error http 403 from valid token while reaching secure path. Do you have any idea about this Access Denied
? when I use 2.7.0 it was working fine.

[larc]

When I try to retrieve the refresh token from a custom password grant type, an exception occurs: 'The class with and name of is not in the allowlist. If you believe this class is safe to deserialize.' The possible cause of this issue is the JSON object in the attribute where the value of java.security.Principal is Do you know how to solve this?

[dzMike]

Hi. Thanks very much for this! Sorry to be dumb but are you able to provide an example of how to authenticate? I've tried all combinations of this that I can think of:
curl -H "Authorization: Bearer Y2xpZW50OnNlY3JldA=="

And keep getting 401 (got it running on 9001). I notice that 'authenticate' in the custom password auth provider is never invoked using a debugger. 

Also on only seems to contain "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt"
Thanks again!