Oauth2-SSO | 使用Oauth2实现的SSO单点登录登出，模拟微信/QQ授权码模式授权资源访问

by hsj-xiaokang CSS Version: Current License: No License

X-Ray Key Features Code Snippets Community Discussions(2)Vulnerabilities Install Support

kandi X-RAY | Oauth2-SSO Summary

Oauth2-SSO is a CSS library. Oauth2-SSO has no bugs, it has no vulnerabilities and it has low support. You can download it from GitHub.

使用Oauth2实现的SSO单点登录登出，模拟微信/QQ授权码模式授权资源访问

Support

Quality

Security

License

Reuse

Support

Oauth2-SSO has a low active ecosystem.

It has 7 star(s) with 4 fork(s). There are 1 watchers for this library.

It had no major release in the last 6 months.

Oauth2-SSO has no issues reported. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of Oauth2-SSO is current.

Quality

Oauth2-SSO has no bugs reported.

Security

Oauth2-SSO has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

Oauth2-SSO does not have a standard license declared.

Check the repository for any license declaration and review the terms closely.

Without a license, all rights are reserved, and you cannot use the library in your applications.

Reuse

Oauth2-SSO releases are not available. You will need to build from source code and install.

Installation instructions are not available. Examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of Oauth2-SSO

Get all kandi verified functions for this library.

Oauth2-SSO Key Features

No Key Features are available at this moment for Oauth2-SSO.

Oauth2-SSO Examples and Code Snippets

No Code Snippets are available at this moment for Oauth2-SSO.

Community Discussions

Trending Discussions on Oauth2-SSO

OAuth2 SSO with Spring Boot without the authorization screen

Spring OAuth2: support auth and resource access with both SSO and custom auth server

QUESTION

OAuth2 SSO with Spring Boot without the authorization screen

Asked 2017-Jul-24 at 18:13

I have resource, authorization and _ui applications written using Spring Boot 1.5.3, OAuth2 and MongoDB.

The resources are going to be accessed from mobile apps as well as a couple of web applications (one for regular users and the other one for admins). The apps are quite similar to the samples from the guides by Dave Syer. What different is that the users are stored in the database and the clients are stored in an xml file located in the resources folder of the authorization server.

I am struggling with the logon experience for the web users. Following the guides for the JWT based OAuth app, after the login page, the user is redirected to the authorization screen, which is not the desired behavior. I.e., I don't want my authorization server to ask if the user trusts my web application to access its resources. Instead, I want users redirected to the ui pages right after login, as one would expect.

I found this project on GitHub (very similar to the apps from the guide) which behaves exactly as I want, but once I start customizing it by adding my authentication and authorization implementation, it reverts back to using the authorization screen. Apparently, I am missing something, but I was not able to figure out what exactly.

authorization/src/main/resourcs/application.yml

...

ANSWER

Answered 2017-Jul-24 at 18:13

From http://www.springframework.org/schema/security/spring-security-oauth2.xsd Element client-details-service > complexType client > attribute autoaprove

Scopes or scope patterns that are autoapproved (comma-separated), or just "true" to autoapprove all.

Just add the autoapprove="true" attribute to your trusted-app in client-details.xml. That way the authserver will not request user's confirmation to access the resources.

Here is an example of how to implement this behaviour directly in your Java configuration.

Source https://stackoverflow.com/questions/45136514

QUESTION

Spring OAuth2: support auth and resource access with both SSO and custom auth server

Asked 2017-Mar-29 at 17:42

I've found similar issue but it's unanswered, so I suppose I'm going to duplicate question a little.

I am using Spring OAuth2 to implement separate resource and custom authentification servers. I've already configured interaction with auth server through issuing&validating JWT tokens and everything seems fine.

Now I'm trying to add SSO functionality but really stuck with it. I've researched the official Spring examples and attached guide but it is very short worded when it comes to connecting SSO part with custom server authentication. And actually author uses only external provider resource ('user' info) to show process.

I think it is normal thing to have all this SSO means of authentication and also custom registration. I can see it works well with stackoverflow for example.

I am loking for directions where to find any info about handling on resource server different kind of tokens issued by multiply SSO providers and also from custom auth server. Maybe I can use auth chain to do this and some mean to distinguish token format to know how to process it. Is it possible with Spring OAuth2? Or I need to do this magic somehow manually?

For now I have just one 'maybe strange' idea: To not involve my own resource server with this SSO stuff at all. After receiving Facebook (for example) token - just exchange it for api JWT token with custom auth server (associating or creating user on the way) and then work with resource server on standard basics

EDITED: I've found at least something. I've read about configuring filters in authorization chain and translate given social tokens to my custom JWT-s as 'post authenticate'(not a crazy idea after all). But it mostly done with SpringSocial. So now question is: how to do that? Forgot to say that I am using Password Grant for authentication on custom server. Clients will be only trusted application and I do not even sure about browser client (thinking about only native mobile options). Even if I decide to have browser client I'll make sure it's going to have backend to store sencetive information

...

ANSWER

Answered 2017-Mar-29 at 17:42

Ok, so after struggling to implement such behavior I've stuck with two different libraries (Spring Social & OAuth2). I decided to go my own way and do it with just Spring OAuth2:

I have the resource server, authentication server and client(backed up by Java and uses OAuth2 Client library, but it can be any other client) - my resources can be consumed only with my own JWT auth token given by my own auth server
in a case of a custom registration: client obtains JWT token(with refresh token) from auth server and sends it to the res server. Res server validates it with public key and gives the resource back
in a case of SSO: client obtains Facebook(or other social platform token) and exchanges it for my custom JWT token with my custom auth server. I've implemented this on my auth server using custom SocialTokenGranter(currently handles facebook social token only. For every social network I'll need separate grant type). This class makes an additional call to facebook auth server to validate token and obtain user info. Then it retrieves the social user from my db or creates new and returns JWT token back to the client. No user merging is done by now. it is out of scope for now.

Source https://stackoverflow.com/questions/41578040

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install Oauth2-SSO

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: