How to override RemoteTokenServices about spring-cloud-security

[dsyer]

That's not currently supported with the @Enable* annotations (so you'd have to pull in the various bits that they do yourself). What do you need your custom token services to do?

[NickPadilla]

Hey @dsyer - I appreciate your response! Yeah, so I guess I am not missing anything this time! As the integration with Keycloak has advanced, we realized that having Keycloak verify/decode the access tokens was the most secure route to go. However it looks like the verify/decode endpoint is a GET not POST. So providing a custom RemoteTokenService would be the way to go.

[jesse-russell]

I'm actually having the same issue with ForgeRock's OpenAM right now. Any progress on this feature?

[dsyer]

These features moved to Spring Boot. If you need anything please open tickets there now (it looks to me like you can probably add a @Bean of type ResourceServerTokenServices to override though).

[levik666]

Hi @dsyer

I understand that we could implement ResourceServerTokenServices. However what value we exposed to decouple RemoteTokenServices and we could extend it (make some method protected not private).

For instance, I have error when I call (private method postForMap on RemoteTokenServices#143)

restTemplate.exchange(path, HttpMethod.POST,
				new HttpEntity<MultiValueMap<String, String>>(formData, headers), Map.class)

and without try catch, I don't get responseBody. In addition to that, I could override DefaultResponseErrorHandler I don't get the information from it.

try {
            return restTemplate.exchange(path, HttpMethod.POST,
                            new HttpEntity<>(formData, headers), Map.class).getBody();
        } catch (RestClientException exe) {
            if (exe instanceof HttpClientErrorException) {
                String responseBodyAsString = ((HttpClientErrorException) exe).getResponseBodyAsString();
                logger.error("Can't path " +  path + " responseBodyAsString " + responseBodyAsString);
            }
            throw exe;
        }

Could you please explain why we have such protection in this service, or maybe I miss something?

I'll be really appreciated for any clarification

Thanks,

[dsyer]

This issue is closed. Read the comments (e.g. "These features moved to Spring Boot.").