Spring-Security OAUTH2 and PKCE, IdentityServer4 How do I add code_challenge info

Viewed 12

I am trying to access Identity Server. When I try to access I get an error that says

MessageTemplate: code_challenge is missing

I have a basic Spring Boot Application. How do I get the app to add in the Code Challenge and code Challenge type.

I have tried to add in this:

@Configuration
public class OAuth2ClientConfiguration {

    @Bean
    public SecurityWebFilterChain  pkceFilterChain(ServerHttpSecurity http, ServerOAuth2AuthorizationRequestResolver resolver) {        
        http.authorizeExchange(r -> r.anyExchange().authenticated());
        http.oauth2Login(auth -> auth.authorizationRequestResolver(resolver));
        return http.build();
    }

    @Bean
    public ServerOAuth2AuthorizationRequestResolver pkceResolver(ReactiveClientRegistrationRepository repo) {
        DefaultServerOAuth2AuthorizationRequestResolver resolver = new DefaultServerOAuth2AuthorizationRequestResolver(repo);
        resolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce());
        return resolver;
    }


but that causes an error saying that

Description:

Parameter 0 of method pkceFilterChain in com.landstar.security.poc.securitypoc.config.OAuth2ClientConfiguration required a bean of type 'org.springframework.security.config.web.server.ServerHttpSecurity' that could not be found.


Action:

Consider defining a bean of type 'org.springframework.security.config.web.server.ServerHttpSecurity' in your configuration.

Additional Info

@Configuration
@EnableWebSecurity
public class SecurityConfig {
        private static final String[] WHITE_LIST_URLS = {
                "/user",
                "/helloPublic",
                "/register",
                "/verifyRegistration*",
                "/resendVerifyToken*"
        };


        @Bean
        SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
            http
                    .cors()
                    .and()
                    .csrf()
                    .disable()
                    .authorizeHttpRequests()
                    .antMatchers(WHITE_LIST_URLS).permitAll()
                    .antMatchers("/api/**").authenticated()
                    .and()
                    .oauth2Login(oauth2login ->
                            oauth2login.loginPage("/auth2/authorization/landstar"))                     
                    .logout(l -> l
                            .logoutSuccessUrl("/").permitAll()
                         )
                    .oauth2Client(Customizer.withDefaults());       
            
            return http.build();
        }
        

        
        
    }


Please, any help.!!! thanks

0 Answers
Related