I try to implement OAuth2 with Spring Security and I have studied the samples provided by Spring in the following Github: https://github.com/spring-projects/spring-security-oauth/blob/master/samples/oauth2/tonr/src/main/java/org/springframework/security/oauth/examples/config/WebMvcConfig.java
This OAuth2 sample is divided in two projects :
- tonr: OAuth2 client (OAuth2Client) and
- sparklr: OAuth2 provider (ResourceServer & AuthorizationServer)
Tonr allows to show photos from Sparklr and also includes a Facebook API client to list friends of an account. It seems that once got from one provider, the same token is sent to all OAuth2 providers, even if the token doesn't come from the called provider.
Steps:
- I log in tonr2 (localhost:8080/tonr2/login.jsp)
- I go to Sparklr photos and log in sparklr2 (localhost:8080/tonr2/sparklr/photos & localhost:8080/sparklr2/login.jsp)
- I approve the scope Read and I see photos: OK
- Then I go to Facebook friends page : localhost:8080/tonr2/facebook/info
The sparklr token is sent to Facebook (visible in debug logs), and obviously Facebook returns a 400 Bad Request Error.
If now, I log out from tonr, click directly to Facebook friends page and log in tonr again, it is working; a token is asked to Facebook and access is granted. So the same OAuth2ClientContext and same token are kept from Sparklr to Facebook.
Question: How to separate OAuth2ClientContext to keep the token with its respective resource server?
I tried to instanciate a different OAuth2ClientContext bean for facebookRestTemplate, but the OAuth2 flow is broken with:
@Bean(name = "facebookClientContext")
public OAuth2ClientContext facebookClientContext() {
return new DefaultOAuth2ClientContext();
}
@Bean
public OAuth2RestTemplate facebookRestTemplate(@Qualifier("facebookClientContext") OAuth2ClientContext clientContext) {
...