· 9 years ago · Oct 24, 2016, 01:02 PM
1java.lang.NullPointerException: null
2 at org.springframework.security.oauth2.provider.token.store.JwtTokenStore.convertAccessToken(JwtTokenStore.java:92) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
3 at org.springframework.security.oauth2.provider.token.store.JwtTokenStore.readAccessToken(JwtTokenStore.java:84) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
4 at org.springframework.security.oauth2.provider.token.DefaultTokenServices.loadAuthentication(DefaultTokenServices.java:229) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
5 at org.springframework.security.oauth2.provider.token.DefaultTokenServices$$FastClassBySpringCGLIB$$5a1f25c.invoke(<generated>) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
6 at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) ~[spring-core-4.3.2.RELEASE.jar:4.3.2.RELEASE]
7 at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:651) ~[spring-aop-4.3.2.RELEASE.jar:4.3.2.RELEASE]
8 at org.springframework.security.oauth2.provider.token.DefaultTokenServices$$EnhancerBySpringCGLIB$$ad6a1bf8.loadAuthentication(<generated>) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
9 at org.springframework.security.oauth2.provider.token.DefaultTokenServices$$FastClassBySpringCGLIB$$5a1f25c.invoke(<generated>) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
10 at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) ~[spring-core-4.3.2.RELEASE.jar:4.3.2.RELEASE]
11 at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:651) ~[spring-aop-4.3.2.RELEASE.jar:4.3.2.RELEASE]
12 at org.springframework.security.oauth2.provider.token.DefaultTokenServices$$EnhancerBySpringCGLIB$$dd6c66fe.loadAuthentication(<generated>) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
13 at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationManager.authenticate(OAuth2AuthenticationManager.java:83) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
14 at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:150) ~[spring-security-oauth2-2.0.10.RELEASE.jar:na]
15 at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
16 at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:121) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
17 at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
18 at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
19 at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.3.2.RELEASE.jar:4.3.2.RELEASE]
20 at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
21 at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
22 at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
23 at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
24 at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.3.2.RELEASE.jar:4.3.2.RELEASE]
25 at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
26 at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
27 at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177) ~[spring-security-web-4.1.1.RELEASE.jar:4.1.1.RELEASE]
28 at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) ~[spring-web-4.3.2.RELEASE.jar:4.3.2.RELEASE]
29 at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262) ~[spring-web-4.3.2.RELEASE.jar:4.3.2.RELEASE]
30 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) ~[tomcat-embed-core-8.5.4.jar:8.5.4]
31 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) ~[tomcat-embed-core-8.5.4.jar:8.5.4]
32 at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197) ~[spring-web-4.3.2.RELEASE.jar:4.3.2.RELEASE]
33 at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.3.2.RELEASE.jar:4.3.2.RELEASE]
34 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192) ~[tomcat-embed-core-8.5.4.jar:8.5.4]
35 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165) ~[tomcat-embed-core-8.5.4.jar:8.5.4]
36 at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) ~[tomcat-embed-core-8.5.4.jar:8.5.4]
37 at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:108) [tomcat-embed-core-8.5.4.jar:8.5.4]
38 at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:522) [tomcat-embed-core-8.5.4.jar:8.5.4]
39 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.4.jar:8.5.4]
40 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.5.4.jar:8.5.4]
41 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.4.jar:8.5.4]
42 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349) [tomcat-embed-core-8.5.4.jar:8.5.4]
43 at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:1110) [tomcat-embed-core-8.5.4.jar:8.5.4]
44 at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.4.jar:8.5.4]
45 at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:785) [tomcat-embed-core-8.5.4.jar:8.5.4]
46 at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1425) [tomcat-embed-core-8.5.4.jar:8.5.4]
47 at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.4.jar:8.5.4]
48 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_25]
49 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_25]
50 at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.4.jar:8.5.4]
51 at java.lang.Thread.run(Thread.java:745) [na:1.8.0_25]
52
53GET /api/test HTTP/1.1
54Host: localhost:8090
55Authorization: Bearer MYTOKENHERE
56Cache-Control: no-cache
57
58private static final String RESOURCE_ID = "myapi";
59
60@Configuration
61@EnableResourceServer
62protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
63 @Autowired
64 private JwtAccessTokenConverter jwtAccessTokenConverter;
65
66 @Override
67 public void configure(ResourceServerSecurityConfigurer resources) {
68 // @formatter:off
69 resources
70 .resourceId(RESOURCE_ID).tokenStore(new JwtTokenStore(jwtAccessTokenConverter));
71 // @formatter:on
72 }
73
74 @Override
75 public void configure(HttpSecurity http) throws Exception {
76 // @formatter:off
77 http
78 .csrf().disable()
79 .authorizeRequests()
80 .antMatchers("/api/**").authenticated();
81 // @formatter:on
82 }
83}
84
85@Configuration
86@EnableAuthorizationServer
87protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
88 @Autowired
89 private JwtAccessTokenConverter jwtAccessTokenConverter;
90
91 private TokenStore tokenStore = new JwtTokenStore(jwtAccessTokenConverter);
92
93 @Autowired
94 @Qualifier("authenticationManagerBean")
95 private AuthenticationManager authenticationManager;
96
97 @Override
98 public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
99 // @formatter:off
100 endpoints
101 .tokenStore(tokenStore)
102 .authenticationManager(authenticationManager)
103 .accessTokenConverter(jwtAccessTokenConverter);
104 // @formatter:on
105 }
106
107 @Override
108 public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
109 // @formatter:off
110 clients
111 .inMemory()
112 .withClient("12345")
113 .authorizedGrantTypes("password", "refresh_token")
114 .authorities("USER")
115 .scopes("read", "write")
116 .resourceIds(RESOURCE_ID)
117 .secret("54321")
118 .accessTokenValiditySeconds(2592000) // 30 days
119 .refreshTokenValiditySeconds(3888000); // 15 days more than access token
120 // @formatter:on
121 }
122}
123
124@Configuration
125@EnableWebSecurity
126public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
127
128 @Autowired
129 private Environment env;
130
131 @Autowired
132 private CustomUserDetailsService userDetailsService;
133
134 @Autowired
135 private AccountAuthenticationProvider accountAuthenticationProvider;
136
137 @Override
138 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
139 auth.userDetailsService(userDetailsService);
140 auth.authenticationProvider(accountAuthenticationProvider);
141 }
142
143 @Bean
144 public PasswordEncoder passwordEncoder() {
145 return new BCryptPasswordEncoder();
146 }
147
148 @Override
149 @Bean
150 public AuthenticationManager authenticationManagerBean() throws Exception {
151 return super.authenticationManagerBean();
152 }
153
154 @Bean
155 public JwtAccessTokenConverter jwtAccessTokenConverter() {
156 final JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
157 jwtAccessTokenConverter.setSigningKey(env.getProperty("jwt.secret"));
158 return jwtAccessTokenConverter;
159 }
160
161}
162
163DROP TABLE IF EXISTS `oauth_access_token`;
164CREATE TABLE `oauth_access_token` (
165 `token_id` varchar(255) DEFAULT NULL,
166 `token` mediumblob,
167 `authentication_id` varchar(255) NOT NULL,
168 `user_name` varchar(255) DEFAULT NULL,
169 `client_id` varchar(255) DEFAULT NULL,
170 `authentication` mediumblob,
171 `refresh_token` varchar(255) DEFAULT NULL,
172 PRIMARY KEY (`authentication_id`)
173) ENGINE=InnoDB DEFAULT CHARSET=latin1;
174
175DROP TABLE IF EXISTS `oauth_approvals`;
176CREATE TABLE `oauth_approvals` (
177 `userId` varchar(255) DEFAULT NULL,
178 `clientId` varchar(255) DEFAULT NULL,
179 `scope` varchar(255) DEFAULT NULL,
180 `status` varchar(10) DEFAULT NULL,
181 `expiresAt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
182 `lastModifiedAt` timestamp NOT NULL DEFAULT '0000-00-00 00:00:00'
183) ENGINE=InnoDB DEFAULT CHARSET=latin1;
184
185DROP TABLE IF EXISTS `oauth_client_details`;
186CREATE TABLE `oauth_client_details` (
187 `client_id` varchar(255) NOT NULL,
188 `resource_ids` varchar(255) DEFAULT NULL,
189 `client_secret` varchar(255) DEFAULT NULL,
190 `scope` varchar(255) DEFAULT NULL,
191 `authorized_grant_types` varchar(255) DEFAULT NULL,
192 `web_server_redirect_uri` varchar(255) DEFAULT NULL,
193 `authorities` varchar(255) DEFAULT NULL,
194 `access_token_validity` int(11) DEFAULT NULL,
195 `refresh_token_validity` int(11) DEFAULT NULL,
196 `additional_information` varchar(4096) DEFAULT NULL,
197 `autoapprove` varchar(255) DEFAULT NULL,
198 PRIMARY KEY (`client_id`)
199) ENGINE=InnoDB DEFAULT CHARSET=latin1;
200
201DROP TABLE IF EXISTS `oauth_client_token`;
202CREATE TABLE `oauth_client_token` (
203 `token_id` varchar(255) DEFAULT NULL,
204 `token` mediumblob,
205 `authentication_id` varchar(255) NOT NULL,
206 `user_name` varchar(255) DEFAULT NULL,
207 `client_id` varchar(255) DEFAULT NULL,
208 PRIMARY KEY (`authentication_id`)
209) ENGINE=InnoDB DEFAULT CHARSET=latin1;
210
211DROP TABLE IF EXISTS `oauth_code`;
212CREATE TABLE `oauth_code` (
213 `code` varchar(255) DEFAULT NULL,
214 `authentication` mediumblob
215) ENGINE=InnoDB DEFAULT CHARSET=latin1;
216
217DROP TABLE IF EXISTS `oauth_refresh_token`;
218CREATE TABLE `oauth_refresh_token` (
219 `token_id` varchar(255) DEFAULT NULL,
220 `token` mediumblob,
221 `authentication` mediumblob
222) ENGINE=InnoDB DEFAULT CHARSET=latin1;
223
224private TokenStore tokenStore = new JwtTokenStore(jwtAccessTokenConverter);
225
226@Override
227 public void configure(ResourceServerSecurityConfigurer resources) {
228 resources.resourceId(RESOURCE_ID).tokenStore(new JwtTokenStore(jwtAccessTokenConverter));
229 }
230
231@Autowired
232 DataSource dataSource;
233
234 @Bean
235 public TokenStore tokenStore() {
236 return new JdbcTokenStore(dataSource);
237 }
238
239@Autowired
240private TokenStore tokenStore;
241
242public void configure(ResourceServerSecurityConfigurer resources) {
243 resources.resourceId(RESOURCE_ID).tokenStore(tokenStore);
244 }