I'm programming a client (Spring Boot application) which has to provide two endpoints for a user, one which uses Authorization Code Grant, and the other which uses Resource Owner Password Credentials Grant. Endpoints are on different URLs. The other one will be used by internal application so I'm not concerned about security.
I have an external OAuth2 server (both authorization and resource server) - so I'm not programming those but I have full access to their configuration. Keycloak is in question.
I've managed to set up Authorization Code Grant, but cannot get the other one to work.
My application.yml looks something like:
security:
oauth2:
resource:
token-info-uri: ...3rd party...
userInfoUri: ...3rd party...
client:
client-id: ...
client-secret: ...
grant-type: authorization_code
registered-redirect-uri: http://localhost:8080/app/auth_grant
pre-established-redirect-uri: http://localhost:8080/app/auth_grant/
user-authorization-uri: ...3rd party uri...
access-token-uri: ...3rd party uri...
scope:
- read
- write
- openid
I have an WebSecurityConfigurerAdapter implementation annotated with @EnableOAuth2Sso
@Configuration which permits only /login to be accessed unauthorized.
Now I want my users to be able to login with Resource Owner Password Credentials Grant at (example) /login_ROPCG.
I've read the documentation but I guess I've headed in the wrong direction. Can you give me some hints?
I've read this comment: Spring Boot Oauth2 use multiple grant_types for for same URL In which the hint is that I need two different security configurations with different mapping but I don't know how to do this.
I've read this: How can I implement Basic Authentication with JWT authentication in Spring Boot? but I don't see how to set two different grant types.
And because of this I'm not sure is this even possible: https://github.com/spring-projects/spring-boot/issues/14554