Thursday, August 23, 2012

Spring security expressions not working with OAUTH2

When using spring security OAUTH2 in a client app, you will normally define an access decision manager like this:


That is needed to add the OAUTH2 scope voter to the auth decision process. Well, that is going to mess with the element if you're using it and have use-expressions="true". 

So even if you have:

your expressions will not work. You will get a stack trace like the following:

java.lang.IllegalArgumentException: Unsupported configuration attributes: [hasRole('ROLE_USER'), permitAll]...

That's because of the above custom definition of the accessDecisionManager bean. You need to switch the RoleVoter definition in the accessDecisionManager for a WebExpressionVoter in order for the web expressions to become available, just like this:


Here you go,
Enjoy Spring Security (with OAUTH2) as before.


at

9 comments:

  1. Anonymous7:14 pm

    Thank you very much !, I spent a lot of time to find this as I am a Oauth newbie.

    ReplyDelete
  2. Anonymous9:48 pm

    Fantistic. Thanks!

    ReplyDelete
  3. Unknown10:19 pm

    Thanks for the post. One thing to add:
    If you plan to use any of the oauth2 expressions like oauth2.hasScope or oauth2.clientHasRole you'll also need to configure the web expression handler as a property of the voter. For example (apologies for formatting):

    <bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
    <property name="expressionHandler" ref="oauthWebExpressionHandler" />
    </bean>

    ReplyDelete
  4. Anonymous2:57 pm

    Thank you very much !

    ReplyDelete
  5. Puneet Dwivedi8:41 pm

    Very helpful. Thanks for post

    ReplyDelete
  6. Richard7:59 pm

    You just saved my bacon

    ReplyDelete
  7. Anonymous8:19 am

    i love you so much! thank you !!!

    ReplyDelete
  8. Anonymous9:50 am

    Thanks a bunch! That helped me a lot!

    ReplyDelete
  9. Brittany D4:39 pm

    Great readingg your blog post

    ReplyDelete