spring-attic / spring-cloud-security Goto Github PK

View Code? Open in Web Editor NEW

528.0 78.0 244.0 2.73 MB

Security concerns for distributed applications implemented in Spring

License: Apache License 2.0

Ruby 3.51% Shell 2.93% Java 93.56%

java spring spring-boot spring-cloud oauth2 zuul feign cloud-native microservices spring-cloud-core

spring-cloud-security's Issues

Quickstart samples are not working

I tried running the Quickstart samples as they are show in the qucikstart documentation but I am getting errors.

$ spring jar app.jar app.groovy
Resolving dependencies............
startup failed:
General error during conversion: org.eclipse.aether.resolution.DependencyResolutionException: Could not find artifact ::jar: in local (file:/Users/ryanjbaxter/.m2/repository/)

org.springframework.boot.cli.compiler.grape.DependencyResolutionFailedException: org.eclipse.aether.resolution.DependencyResolutionException: Could not find artifact ::jar: in local (file:/Users/ryanjbaxter/.m2/repository/)
    at org.springframework.boot.cli.compiler.grape.AetherGrapeEngine.resolve(AetherGrapeEngine.java:223)
    at org.springframework.boot.cli.compiler.grape.AetherGrapeEngine.grab(AetherGrapeEngine.java:113)
    at groovy.grape.Grape.grab(Grape.java:163)
    at groovy.grape.GrabAnnotationTransformation.visit(GrabAnnotationTransformation.java:360)
    at org.codehaus.groovy.transform.ASTTransformationVisitor$3.call(ASTTransformationVisitor.java:319)
    at org.codehaus.groovy.control.CompilationUnit.applyToSourceUnits(CompilationUnit.java:923)
    at org.codehaus.groovy.control.CompilationUnit.doPhaseOperation(CompilationUnit.java:585)
    at org.codehaus.groovy.control.CompilationUnit.processPhaseOperations(CompilationUnit.java:561)
    at org.codehaus.groovy.control.CompilationUnit.compile(CompilationUnit.java:538)
    at org.springframework.boot.cli.compiler.GroovyCompiler.compile(GroovyCompiler.java:197)
    at org.springframework.boot.cli.command.jar.JarCommand$JarOptionHandler.run(JarCommand.java:124)
    at org.springframework.boot.cli.command.options.OptionHandler.run(OptionHandler.java:92)
    at org.springframework.boot.cli.command.OptionParsingCommand.run(OptionParsingCommand.java:53)
    at org.springframework.boot.cli.command.CommandRunner.run(CommandRunner.java:217)
    at org.springframework.boot.cli.command.CommandRunner.runAndHandleErrors(CommandRunner.java:170)
    at org.springframework.boot.cli.SpringCli.main(SpringCli.java:51)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:606)
    at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:53)
    at java.lang.Thread.run(Thread.java:744)
Caused by: org.eclipse.aether.resolution.DependencyResolutionException: Could not find artifact ::jar: in local (file:/Users/ryanjbaxter/.m2/repository/)
    at org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveDependencies(DefaultRepositorySystem.java:405)
    at org.springframework.boot.cli.compiler.grape.AetherGrapeEngine.resolve(AetherGrapeEngine.java:214)
    ... 21 more
Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Could not find artifact ::jar: in local (file:/Users/ryanjbaxter/.m2/repository/)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:462)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:264)
    at org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveDependencies(DefaultRepositorySystem.java:388)
    ... 22 more
Caused by: org.eclipse.aether.transfer.ArtifactNotFoundException: Could not find artifact ::jar: in local (file:/Users/ryanjbaxter/.m2/repository/)
    at org.eclipse.aether.connector.basic.ArtifactTransportListener.transferFailed(ArtifactTransportListener.java:39)
    at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:355)
    at org.eclipse.aether.util.concurrency.RunnableErrorForwarder$1.run(RunnableErrorForwarder.java:67)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    ... 1 more

1 error

I am guessing this is because the jars are not in the central maven repo yet. What needs to be added to the groovy code so they will build?

Is there a nightly build for the spring-cloud-projects

I was just wondering if there was a nightly snapshot build for the spring-cloud stuff available.

spring.oauth2.resource.jwt.keyUri does not retrieve key from a protected endpoint

When configuring spring.oauth2.resource.jwt.keyUri, if the endpoint is unprotected (eg if the key is a public key) the application will retrieve the key. If the endpoint is protected (eg if the key is a symmetric key) the RestTemplate [1] will throw an HttpClientErrorException: 401 Unauthorized and the application will not start up.

We could catch the 401 and try again with the credentials in the ResourceServerProperties, or just use those credentials on the first request.

[1] https://github.com/spring-cloud/spring-cloud-security/blob/f31cb05807bf53355cb22219bc7f5d7300542aea/src/main/java/org/springframework/cloud/security/oauth2/resource/ResourceServerTokenServicesConfiguration.java#L267-L268

Provide autoconfig for Config Client

See spring-cloud/spring-cloud-config#9 for some discussion

Possible CSRF detected - state parameter was present but no state could be found

When i try to create a Spring OAuth server, like this, in Spring blog, i get an error:

curl -X GET http://localhost:8080 -v -L -u user:password

Rebuilt URL to: http://localhost:8080/
Hostname was NOT found in DNS cache
Trying 127.0.0.1...
Connected to localhost (127.0.0.1) port 8080 (#0)
Server auth using Basic with user 'user' > GET / HTTP/1.1 > Authorization: Basic dXNlcjpwYXNzd29yZA== > User-Agent: curl/7.35.0 > Host: localhost:8080 > Accept: / > < HTTP/1.1 302 Found
Server Apache-Coyote/1.1 is not blacklisted < Server: Apache-Coyote/1.1 < X-Content-Type-Options: nosniff < X-XSS-Protection: 1; mode=block < Cache-Control: no-cache, no-store, max-age=0, must-revalidate < Pragma: no-cache < Expires: 0 < X-Frame-Options: DENY < Set-Cookie: JSESSIONID=16E880F53147AF4FA4C598615CFE97D4; Path=/; HttpOnly < Location: http://localhost:8080/login < Content-Length: 0 < Date: Wed, 26 Nov 2014 19:38:18 GMT <
Connection #0 to host localhost left intact
Issue another request to this URL: 'http://localhost:8080/login'
Found bundle for host localhost: 0x15cf8b0
Re-using existing connection! (#0) with host localhost
Connected to localhost (127.0.0.1) port 8080 (#0)
Server auth using Basic with user 'user' > GET /login HTTP/1.1 > Authorization: Basic dXNlcjpwYXNzd29yZA== > User-Agent: curl/7.35.0 > Host: localhost:8080 > Accept: / > < HTTP/1.1 302 Found
Server Apache-Coyote/1.1 is not blacklisted < Server: Apache-Coyote/1.1 < X-Content-Type-Options: nosniff < X-XSS-Protection: 1; mode=block < Cache-Control: no-cache, no-store, max-age=0, must-revalidate < Pragma: no-cache < Expires: 0 < X-Frame-Options: DENY < Set-Cookie: JSESSIONID=8BCDD1F49074CA6239BC1E93903180F3; Path=/; HttpOnly < Location: http://localhost:9998/oauth/authorize?client_id=my-trusted-client&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Flogin&response_type=code&state=Bvp1wZ < Content-Length: 0 < Date: Wed, 26 Nov 2014 19:38:18 GMT <
Connection #0 to host localhost left intact
Issue another request to this URL: 'http://localhost:9998/oauth/authorize?client_id=my-trusted-client&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Flogin&response_type=code&state=Bvp1wZ'
Found bundle for host localhost: 0x15cf8b0
Hostname was NOT found in DNS cache
Trying 127.0.0.1...
Connected to localhost (127.0.0.1) port 9998 (#1)
Server auth using Basic with user 'user' > GET /oauth/authorize?client_id=my-trusted-client&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Flogin&response_type=code&state=Bvp1wZ HTTP/1.1 > Authorization: Basic dXNlcjpwYXNzd29yZA== > User-Agent: curl/7.35.0 > Host: localhost:9998 > Accept: / > < HTTP/1.1 302 Found
Server Apache-Coyote/1.1 is not blacklisted < Server: Apache-Coyote/1.1 < Strict-Transport-Security: max-age=31536000 ; includeSubDomains < Pragma: no-cache < Expires: Thu, 01 Jan 1970 00:00:00 GMT < Cache-Control: no-cache < Cache-Control: no-store < Location: http://localhost:8080/login?code=2eJuuj&state=Bvp1wZ < Content-Language: pt-PT < Content-Length: 0 < Date: Wed, 26 Nov 2014 19:38:18 GMT <
Connection #1 to host localhost left intact
Issue another request to this URL: 'http://localhost:8080/login?code=2eJuuj&state=Bvp1wZ'
Found bundle for host localhost: 0x15cf8b0
Re-using existing connection! (#0) with host localhost
Connected to localhost (127.0.0.1) port 8080 (#0)
Server auth using Basic with user 'user' > GET /login?code=2eJuuj&state=Bvp1wZ HTTP/1.1 > Authorization: Basic dXNlcjpwYXNzd29yZA== > User-Agent: curl/7.35.0 > Host: localhost:8080 > Accept: / > < HTTP/1.1 500 Internal Server Error
Server Apache-Coyote/1.1 is not blacklisted < Server: Apache-Coyote/1.1 < X-Content-Type-Options: nosniff < X-XSS-Protection: 1; mode=block < Cache-Control: no-cache, no-store, max-age=0, must-revalidate < Pragma: no-cache < Expires: 0 < X-Frame-Options: DENY < Set-Cookie: JSESSIONID=BB959926086631B7120D7B9ED51C385D; Path=/; HttpOnly < Content-Type: application/json;charset=UTF-8 < Transfer-Encoding: chunked < Date: Wed, 26 Nov 2014 19:38:18 GMT < Connection: close <
Closing connection 0 {"timestamp":1417030698602,"status":500,"error":"Internal Server Error","exception":"org.springframework.security.oauth2.common.exceptions.InvalidRequestException","message":"Possible CSRF detected - state parameter was present but no state could be found","path":"/login"}

Apparently, state param is not maintained between different requests, by OAuthRestTemplate.

Cannot use empty resource id.

Field org.springframework.cloud.security.oauth2.resource.ResourceServerProperties.id is initialized on empty string when the property oauth2.resource.id is undefined, whilst it should have been initialized on null.

Later on this value is used in org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationManager to authenticate a user and when resource id is not null but an object an exception is raised.

The workaround is of course to define oauth2.resource.id, but unfortunately this value has to be known to the Authorization Server, which issues a token. This isn't always practical - in simple cases it would be good to not have to define a resource id.

Decode JWT locally when using @EnableOAuth2Resource

For example to get a resource to work with UAA, so it could decode the JWT without making the userinfo callback, I had to switch back to using the spring-security-oauth2 @EnableResourceServer, extend the ResourceServerConfigurerAdapter and set a JwtTokenStore, etc.

When authserver is not up fatal exception prevents application from starting

I have an api-gateway application. It dies an ugly death if the auth-server is not running when its trying to start. It is especially noticeable on a fig up command where it usually seems to take a bit longer to start the auth-server. I was wondering if it would be possible to do something more like redis etc. Where an error is logged but it just tries to recover until things are up and stable.

The exception was a doozy but the whole thing is listed below:

2015-01-05 12:59:24.997 ERROR 41821 --- [           main] o.s.boot.SpringApplication               : Application startup failed

org.springframework.context.ApplicationContextException: Unable to start embedded container; nested exception is org.springframework.boot.context.embedded.EmbeddedServletContainerException: Unable to start embedded Tomcat
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.onRefresh(EmbeddedWebApplicationContext.java:124)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:474)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:109)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:691)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:321)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:961)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:950)
    at org.springframework.boot.SpringApplication$run.call(Unknown Source)
    at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:45)
    at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:108)
    at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:120)
    at com.acme.demo.gateway.ApiGatewayApplication.main(ApiGatewayApplication.groovy:26)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:53)
    at java.lang.Thread.run(Thread.java:745)
Caused by: org.springframework.boot.context.embedded.EmbeddedServletContainerException: Unable to start embedded Tomcat
    at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainer.initialize(TomcatEmbeddedServletContainer.java:97)
    at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainer.<init>(TomcatEmbeddedServletContainer.java:74)
    at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory.getTomcatEmbeddedServletContainer(TomcatEmbeddedServletContainerFactory.java:374)
    at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory.getEmbeddedServletContainer(TomcatEmbeddedServletContainerFactory.java:150)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.createEmbeddedServletContainer(EmbeddedWebApplicationContext.java:148)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.onRefresh(EmbeddedWebApplicationContext.java:121)
    ... 17 common frames omitted
Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'securityFilterChainRegistration' defined in class path resource [org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.class]: Unsatisfied dependency expressed through constructor argument with index 0 of type [javax.servlet.Filter]: : Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.setFilterChainProxySecurityConfigurer(org.springframework.security.config.annotation.ObjectPostProcessor,java.util.List) throws java.lang.Exception; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.setFilterChainProxySecurityConfigurer(org.springframework.security.config.annotation.ObjectPostProcessor,java.util.List) throws java.lang.Exception; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:752)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:467)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:198)
    at org.springframework.boot.context.embedded.ServletContextInitializerBeans.getOrderedBeansOfType(ServletContextInitializerBeans.java:176)
    at org.springframework.boot.context.embedded.ServletContextInitializerBeans.addServletContextInitializerBeans(ServletContextInitializerBeans.java:80)
    at org.springframework.boot.context.embedded.ServletContextInitializerBeans.<init>(ServletContextInitializerBeans.java:68)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.getServletContextInitializerBeans(EmbeddedWebApplicationContext.java:216)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext$1.onStartup(EmbeddedWebApplicationContext.java:202)
    at org.springframework.boot.context.embedded.tomcat.ServletContextInitializerLifecycleListener.lifecycleEvent(ServletContextInitializerLifecycleListener.java:64)
    at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
    at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:90)
    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5095)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1409)
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1399)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    ... 1 common frames omitted
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.setFilterChainProxySecurityConfigurer(org.springframework.security.config.annotation.ObjectPostProcessor,java.util.List) throws java.lang.Exception; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:334)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1202)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:371)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.findAutowireCandidates(DefaultListableBeanFactory.java:1127)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1051)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:949)
    at org.springframework.beans.factory.support.ConstructorResolver.resolveAutowiredArgument(ConstructorResolver.java:816)
    at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:744)
    ... 25 common frames omitted
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.setFilterChainProxySecurityConfigurer(org.springframework.security.config.annotation.ObjectPostProcessor,java.util.List) throws java.lang.Exception; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:646)
    at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:87)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:331)
    ... 46 common frames omitted
Caused by: org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:164)
    at org.springframework.beans.factory.support.AbstractBeanFactory.evaluateBeanDefinitionString(AbstractBeanFactory.java:1354)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:964)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:949)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:603)
    ... 48 common frames omitted
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:334)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1202)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:198)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeansOfType(DefaultListableBeanFactory.java:523)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeansOfType(DefaultListableBeanFactory.java:512)
    at org.springframework.security.config.annotation.web.configuration.AutowiredWebSecurityConfigurersIgnoreParents.getWebSecurityConfigurers(AutowiredWebSecurityConfigurersIgnoreParents.java:52)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.springframework.expression.spel.support.ReflectiveMethodExecutor.execute(ReflectiveMethodExecutor.java:112)
    at org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:129)
    at org.springframework.expression.spel.ast.MethodReference.access$000(MethodReference.java:49)
    at org.springframework.expression.spel.ast.MethodReference$MethodValueRef.getValue(MethodReference.java:342)
    at org.springframework.expression.spel.ast.CompoundExpression.getValueInternal(CompoundExpression.java:88)
    at org.springframework.expression.spel.ast.SpelNodeImpl.getValue(SpelNodeImpl.java:120)
    at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:242)
    at org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:161)
    ... 52 common frames omitted
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:558)
    at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:87)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:331)
    ... 74 common frames omitted
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:602)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.findAutowireCandidates(DefaultListableBeanFactory.java:1127)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1051)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:949)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:530)
    ... 76 common frames omitted
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:591)
    ... 88 common frames omitted
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:602)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:322)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.jwtTokenStore(<generated>)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration.jwtTokenServices(ResourceServerTokenServicesConfiguration.java:151)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.CGLIB$jwtTokenServices$1(<generated>)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db$$FastClassBySpringCGLIB$$1d94af5d.invoke(<generated>)
    at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:309)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.jwtTokenServices(<generated>)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162)
    ... 89 common frames omitted
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:591)
    ... 110 common frames omitted
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1566)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:539)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:322)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.jwtTokenEnhancer(<generated>)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration.jwtTokenStore(ResourceServerTokenServicesConfiguration.java:157)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.CGLIB$jwtTokenStore$2(<generated>)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db$$FastClassBySpringCGLIB$$1d94af5d.invoke(<generated>)
    at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:309)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.jwtTokenStore(<generated>)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162)
    ... 111 common frames omitted
Caused by: java.lang.NullPointerException: null
    at org.springframework.security.jwt.crypto.sign.MacSigner.<init>(MacSigner.java:34)
    at org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter.afterPropertiesSet(JwtAccessTokenConverter.java:245)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1625)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1562)
    ... 130 common frames omitted

java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:53)
    at java.lang.Thread.run(Thread.java:745)
Caused by: org.springframework.context.ApplicationContextException: Unable to start embedded container; nested exception is org.springframework.boot.context.embedded.EmbeddedServletContainerException: Unable to start embedded Tomcat
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.onRefresh(EmbeddedWebApplicationContext.java:124)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:474)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:109)
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:691)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:321)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:961)
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:950)
    at org.springframework.boot.SpringApplication$run.call(Unknown Source)
    at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:45)
    at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:108)
    at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:120)
    at com.acme.demo.gateway.ApiGatewayApplication.main(ApiGatewayApplication.groovy:26)
    ... 6 more
Caused by: org.springframework.boot.context.embedded.EmbeddedServletContainerException: Unable to start embedded Tomcat
    at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainer.initialize(TomcatEmbeddedServletContainer.java:97)
    at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainer.<init>(TomcatEmbeddedServletContainer.java:74)
    at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory.getTomcatEmbeddedServletContainer(TomcatEmbeddedServletContainerFactory.java:374)
    at org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory.getEmbeddedServletContainer(TomcatEmbeddedServletContainerFactory.java:150)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.createEmbeddedServletContainer(EmbeddedWebApplicationContext.java:148)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.onRefresh(EmbeddedWebApplicationContext.java:121)
    ... 17 more
Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'securityFilterChainRegistration' defined in class path resource [org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.class]: Unsatisfied dependency expressed through constructor argument with index 0 of type [javax.servlet.Filter]: : Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.setFilterChainProxySecurityConfigurer(org.springframework.security.config.annotation.ObjectPostProcessor,java.util.List) throws java.lang.Exception; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.setFilterChainProxySecurityConfigurer(org.springframework.security.config.annotation.ObjectPostProcessor,java.util.List) throws java.lang.Exception; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:752)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:467)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:198)
    at org.springframework.boot.context.embedded.ServletContextInitializerBeans.getOrderedBeansOfType(ServletContextInitializerBeans.java:176)
    at org.springframework.boot.context.embedded.ServletContextInitializerBeans.addServletContextInitializerBeans(ServletContextInitializerBeans.java:80)
    at org.springframework.boot.context.embedded.ServletContextInitializerBeans.<init>(ServletContextInitializerBeans.java:68)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.getServletContextInitializerBeans(EmbeddedWebApplicationContext.java:216)
    at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext$1.onStartup(EmbeddedWebApplicationContext.java:202)
    at org.springframework.boot.context.embedded.tomcat.ServletContextInitializerLifecycleListener.lifecycleEvent(ServletContextInitializerLifecycleListener.java:64)
    at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
    at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:90)
    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5095)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1409)
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1399)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    ... 1 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.setFilterChainProxySecurityConfigurer(org.springframework.security.config.annotation.ObjectPostProcessor,java.util.List) throws java.lang.Exception; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:334)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1202)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:371)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.findAutowireCandidates(DefaultListableBeanFactory.java:1127)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1051)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:949)
    at org.springframework.beans.factory.support.ConstructorResolver.resolveAutowiredArgument(ConstructorResolver.java:816)
    at org.springframework.beans.factory.support.ConstructorResolver.createArgumentArray(ConstructorResolver.java:744)
    ... 25 more
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.setFilterChainProxySecurityConfigurer(org.springframework.security.config.annotation.ObjectPostProcessor,java.util.List) throws java.lang.Exception; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:646)
    at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:87)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:331)
    ... 46 more
Caused by: org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:164)
    at org.springframework.beans.factory.support.AbstractBeanFactory.evaluateBeanDefinitionString(AbstractBeanFactory.java:1354)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:964)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:949)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:603)
    ... 48 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:334)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1202)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:198)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeansOfType(DefaultListableBeanFactory.java:523)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeansOfType(DefaultListableBeanFactory.java:512)
    at org.springframework.security.config.annotation.web.configuration.AutowiredWebSecurityConfigurersIgnoreParents.getWebSecurityConfigurers(AutowiredWebSecurityConfigurersIgnoreParents.java:52)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.springframework.expression.spel.support.ReflectiveMethodExecutor.execute(ReflectiveMethodExecutor.java:112)
    at org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:129)
    at org.springframework.expression.spel.ast.MethodReference.access$000(MethodReference.java:49)
    at org.springframework.expression.spel.ast.MethodReference$MethodValueRef.getValue(MethodReference.java:342)
    at org.springframework.expression.spel.ast.CompoundExpression.getValueInternal(CompoundExpression.java:88)
    at org.springframework.expression.spel.ast.SpelNodeImpl.getValue(SpelNodeImpl.java:120)
    at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:242)
    at org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:161)
    ... 52 more
Caused by: org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.security.oauth2.provider.token.ResourceServerTokenServices org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfiguration.tokenServices; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:558)
    at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:87)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:331)
    ... 74 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenServices' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:602)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.findAutowireCandidates(DefaultListableBeanFactory.java:1127)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1051)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:949)
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:530)
    ... 76 more
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.ResourceServerTokenServices]: Factory method 'jwtTokenServices' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:591)
    ... 88 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenStore' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:602)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:322)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.jwtTokenStore(<generated>)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration.jwtTokenServices(ResourceServerTokenServicesConfiguration.java:151)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.CGLIB$jwtTokenServices$1(<generated>)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db$$FastClassBySpringCGLIB$$1d94af5d.invoke(<generated>)
    at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:309)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.jwtTokenServices(<generated>)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162)
    ... 89 more
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.provider.token.TokenStore]: Factory method 'jwtTokenStore' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:591)
    ... 110 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtTokenEnhancer' defined in class org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration: Invocation of init method failed; nested exception is java.lang.NullPointerException
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1566)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:539)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:302)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:298)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:322)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.jwtTokenEnhancer(<generated>)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration.jwtTokenStore(ResourceServerTokenServicesConfiguration.java:157)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.CGLIB$jwtTokenStore$2(<generated>)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db$$FastClassBySpringCGLIB$$1d94af5d.invoke(<generated>)
    at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:309)
    at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$9dbe9db.jwtTokenStore(<generated>)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:483)
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162)
    ... 111 more
Caused by: java.lang.NullPointerException
    at org.springframework.security.jwt.crypto.sign.MacSigner.<init>(MacSigner.java:34)
    at org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter.afterPropertiesSet(JwtAccessTokenConverter.java:245)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1625)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1562)
    ... 130 more

Can't get @EnableOAuth2Sso to trigger in test case

I'm currently using @EnableOAuth2Sso and @EnableOAuth2Resource as meta-annotations on an abstracted security library we're writing, and I'm having some issues in the unit tests. I'm fairly certain this isn't a code issue, just a PEBCAK issue, but I'm wondering how I can test that these annotations are importing the correct configuration in a JUnit configuration? I can see that security is being applied, but in cases where I expect to be redirected to the log in page, I get a 401 with Basic in the WWW-Authenticate header.

Problematic condition on OAuth2ResourceConfiguration

org.springframework.cloud.security.oauth2.resource.OAuth2ResourceConfiguration, line 43:

@ConditionalOnExpression("'${oauth2.client.clientId}'!=''")

This annotation forces a resource server to have clientId defined. I think it should be replaced by a property with prefix "oauth2.resource" or removed at all.

Best way to provide oauth2 login redirect

I am wondering if there was a way to trigger a redirect to the oauth2 authentication server. I am implementing a custom RemoteTokenServices and want to trigger the redirect if the token is invalid. This would be just a first step to getting full refresh access token functionality added.

Apparent bean wiring paradox in `@ConfigurationProperties` objects for SSO

We've built a library to use spring-cloud-security to provide SSO to our developers behind an abstraction layer (in case, for example, the powers that be decide they don't want to use OAuth2). I upgraded the dependencies yesterday from 1.0.0.M3 to 1.0.0.RELEASE and now I'm seeing quite the odd paradox in one situation.

When I try to start my app, which has @EnableResourceServer present, I get an exception that ResourceServerProperties.Jwt.keyUri is null, even though I can see in the logs that it's being loaded from my properties file. When I add @EnableConfigurationProperties({ResourceServerProperties.class}) to one of my configuration classes to enable the bean, I then get an error that it can't create the bean, because it's missing a constructor argument of type String.

Exception when @EnableConfigurationProperties is missing:

2015-03-12T10:12:03.09-0600 [App/0]   OUT Caused by: java.lang.IllegalArgumentException: 'uriTemplate' must not be null
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.util.Assert.hasText(Assert.java:162)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.web.util.UriTemplate$Parser.<init>(UriTemplate.java:179)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.web.util.UriTemplate$Parser.<init>(UriTemplate.java:172)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.web.util.UriTemplate.<init>(UriTemplate.java:65)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:528)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.web.client.RestTemplate.getForObject(RestTemplate.java:236)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration.jwtTokenEnhancer(ResourceServerTokenServicesConfiguration.java:247)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$6c1b5783.CGLIB$jwtTokenEnhancer$2(<generated>)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$6c1b5783$$FastClassBySpringCGLIB$$d4ad3e27.invoke(<generated>)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:309)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration$$EnhancerBySpringCGLIB$$6c1b5783.jwtTokenEnhancer(<generated>)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at java.lang.reflect.Method.invoke(Method.java:483)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162)
2015-03-12T10:12:03.09-0600 [App/0]   OUT       ... 91 more

Exception when @EnableConfigurationProperties is present:

2015-03-12T10:07:43.99-0600 [App/0]   OUT Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire field: private org.springframework.cloud.security.oauth2.resource.ResourceServerProperties org.springframework.cloud.security.oauth2.resource.ResourceServerTokenServicesConfiguration$JwtTokenServicesConfiguration.resource; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'spring.oauth2.resource.CONFIGURATION_PROPERTIES': Unsatisfied dependency expressed through constructor argument with index 0 of type [java.lang.String]: : No qualifying bean of type [java.lang.String] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [java.lang.String] found for dependency: expected at least 1 bean which qualifies as autowire candidate for this dependency. Dependency annotations: {}
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:334)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1202)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:368)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1111)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1006)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.DefaultListableBeanFactory.findAutowireCandidates(DefaultListableBeanFactory.java:1120)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:1044)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.support.DefaultListableBeanFactory.resolveDependency(DefaultListableBeanFactory.java:942)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredFieldElement.inject(AutowiredAnnotationBeanPostProcessor.java:533)
2015-03-12T10:07:43.99-0600 [App/0]   OUT   ... 56 more

Any thoughts on what changed between M3 and RELEASE that could have caused this? Thanks!

OAuth2ClientProperties is redundant

OAuth2ClientProperties is redundant - we can just use an instance of AuthorizationCodeResourceDetails.

Token relay pattern: service secured with oauth to call another oauth secured service

See spring-cloud/spring-cloud-netflix#230

Migrate generic code from spring-cloud-cloudfoundry

Call to token endpoint does not support basic authentication

When using @EnableOAuth2Sso with UAA, after the redirect back with the authorization code, it tries to call the token endpoint to get an access token, but it always fails with a 401 and WWW-Authenticate: Basic ...

It seems it is passing the client_id and client_secret in the POST data but UAA wants a Basic header instead.

If I understand the spec here, the authorization server must support Basic authentication for the client credentials, and MAY support the client_secret parameter.

http://tools.ietf.org/html/rfc6749#section-2.3.1

Manage cookies for backends in zuul proxy

The only way cookies work right now is if the backends don't send "set-cookie" headers. It would be cleaner to allow that as well but if the "set-cookie" header appears on backend responses, store them in a sane way on the proxy and replay them to the same backend on the next request.

Authentication Header Not Proxied

Not sure if this should go in this project or the netflix project.

In my project sometimes the Zuul proxy does not forward the authentication header after logging in. This seems to happen sporadically, I perform one operation which issues a request through the proxy to the resource server and the authentication header is in the request and then immediately afterwards perform the same operation and the header is not forwarded. Once that happens the proxy will no longer forward the header. I have not been able to find exact steps to reproduce it yet :( It seems like the auth token is no longer valid but I am not waiting a long time between logging in and making the request through the proxy. Even if it was invalid I would still expect the proxy to pass the expired auth token.

Ribbon support to contact the auth server

it would be great if I could replace localhost:9999 with the name of the eureka service id

spring:
  application:
    name: ui-service
  oauth2:
    sso:
      home:
        secure: false
        path: /,/**/*.html
    client:
      accessTokenUri: http://localhost:9999/uaa/oauth/token
      userAuthorizationUri: http://localhost:9999/uaa/oauth/authorize
      clientId: acme
      clientSecret: acmesecret

Add support for Ribbon client in OAuth2RestTemplate

should not "spring.oauth2.resource.id" be mapped to resourceId?

Should not the property spring.oauth2.resource.id be mapped automatically to resourceId without having to explicitly define the in the ResourceServerSecurityConfigurer?

ResourceServerProperties class looks like it should

...
public String getResourceId() {
    return id;
}

Clarify use of user roles and (maybe also) basic auth for actuator endpoints

Declarative configuration of which routes require OAuth2 authentication

E.g.

oauth2:
  proxy:
     routes:
        customers: true

OAuth2SsoConfigurers can't customize request security

It looks like any HttpSecurity configuration defined in a OAuth2SsoConfigurer is getting ignored due to the order that HttpSecurity is configured in OAuth2SsoConfiguration. Since OAuth2SsoConfiguration adds the fallback anyRequest().authenticated() request matcher before any of the configurers are applied, requests only ever hit that matcher and use that expression to determine access.

I moved that fallback request matcher below the configurer loop on a fork and it seems to work.

Ability to replace/configure the default success/failure handler in OAuth2ClientAuthenticationProcessingFilter

I have a Spring Boot app acting as a gateway to a SPA. The gateway main class is decorated with @SpringBootApplication, @EnableZuulProxy and @EnableOAuth2Sso

I'd like to host the SPA on a dedicated server (I'm using a Gulp toolchain to develop the SPA) and on successful authentication the gateway to redirect back to the SPA.

I'm trying to achieve this by having the SPA make login requests to a bogus gateway endpoint requiring authentication and consequently kicking off the ExceptionTranslationFilter
To make the redirect back to the SPA I assumed I could configure OAuth2ClientAuthenticationProcessingFilter to use as success handler a SavedRequestAwareAuthenticationSuccessHandler with the useReferer option enabled

Is there a way to replace/configure the default success/failure handler in OAuth2ClientAuthenticationProcessingFilter?

OAuth2ProxyAutoConfiguration should not require Zuul

Currently, when trying to use the OAuth2 support it does not auto-configure without Zuul installed.

"OAuth2ProxyAutoConfiguration": [
  {
    "condition": "OnClassCondition",
    "message": "required @ConditionalOnClass classes not found: com.netflix.zuul.ZuulFilter,org.springframework.security.oauth2.config.annotation.web.configuration.EnableOAuth2Client"
  }
]

I'm not using Zuul for anything (nor do I plan to at the moment), so the requirement on this library is a bit burdensome (especially since it doesn't come as part of the spring-cloud-starter-security POM).

Add the option to have OAuth2RestTemplate use @LoadBalanced

Possibly also create a non @LoadBalanced OAuth2RestTemplate.

Make /login always do SSO login by default (unless user chooses a different path)

The problem is that when the user carves out a subset of resources for OAuth2 SSO using an OAuth2SsoConfigurer (e.g. "/dashboard/**") then that filter only catches URLs with that pattern, and the redirect to "/login" isn't caught by the right filter. You can change "oauth2.sso.loginPath" to "/dashboard/login" and it works again, but it seems like an extra change that shouldn't really be necessary. (Maybe we can register /login, or "${oauth2.sso.loginPath:/login}", as a path for the SSO filter unless the user says otherwise.)

Configure AuthenticationEntryPoint with @EnableOAuth2Sso

From what I can see in the OAuth2SsoConfiguration class the http.exceptionHandling().authenticationEntryPoint and logout configurer are completed after my configurers so there is no way for me to return a 401 when a login is required. In my SPA application I don't want to receive 'found' or redirects but rather a 401 so that the Angular application can display the login page.

Change Environment property prefixes to spring.oauth2.*

There are changes coming in Spring Boot which will likely mean we ditch a lot of the code in this project, but one thing is for sure, that the prefixes will be spring.oauth2.*, so it's a good idea to change now so we can break fewer applications later.

Add support for Feign on OAuth2 protected resources

I'll be nice if we have some kind of support to include authorization on Feign requests, since I came across this issue, as asked on StackOverflow. I could fix it to my needs, thanks to @dsyer.

I can try to contribuite to this with my implementation, I just don't know how to test this with TDD 😞

Here is the implemetation on a gist

Set up session authentication strategy in sso filter

Set up session authentication strategy in sso filter, otherwise the cookie will not change (unless the container decides it needs to do it, which can happen). Existing apps shouldn't notice the difference, but if we do this then the cookies should flow better.

OAuth2 Resource Server Will Not Reuse OAuth2RestTemplate

In #27 we solved the problem of reusing the OAuth2RestTemplate, however this only works if the application has a client id set, see https://github.com/spring-cloud/spring-cloud-security/blob/1d3865dcba5b17a24d020bdc499de2af61d4438d/src/main/java/org/springframework/cloud/security/oauth2/resource/UserInfoTokenServices.java#L59. When you have a resource server (using @EnableOAuth2Resource) there will be no client id so that means none of the existing OAuth2RestTemplates will be added to the resources variable in UserInfoTokenServices. Because there are no resources that means we will create a new OAuth2RestTemplate in the getMap method and not use the existing one.

Resource server without SSO should be stateless by default

Resource server without SSO should be stateless by default. The problem we have at the minute is that even though Spring Security is not creating sessions by default, the fact that the OAuth2ClientContext is session scoped by default means that we pick up a session anyway. It's not a huge problem but worth fixing because clients behind a proxy do not want to see a Set-Cookie header (probably worth fixing in the proxy filter too).

Add oauth2.client.scope

UserInfoTokenServices could re-use the OAuth2RestTemplate from the application context if there is one

UserInfoTokenServices creates its own OAuth2RestTemplate, but it could grab one from the application context if available (there is only one client normally, but it would have to check that the client ids matched).

Possible misalignment with spring-oauth2's check_token endpoint

I'm trying to use @EnableOAuth2Resource with a spring-oauth2 powered authentication server. The resource server's extractAuthentication() method uses in turn

private Object getPrincipal(Map<String, Object> map) {
    String[] keys = new String[] { "user", "username", "userid", "user_id", "login", 
            "id", "name" };
    for (String key : keys) {
        if (map.containsKey(key)) {
            return map.get(key);
        }
    }
    return "unknown";
}

The authentication server creates a missaligned answer when calling it's check_token endpoint. In DefaultUserAuthenticationConverter the username is placed in user_name which is not part of the checked keys in getPrincipal():

public interface UserAuthenticationConverter  {

final String AUTHORITIES = AccessTokenConverter.AUTHORITIES;

final String USERNAME = "user_name";

Am i missing something?

Cannot Use UserInfoRestTemplateCustomizer When Not A Client

I would like to use UserInfoRestTemplateCustomizer in a resource server that is not a client in order to customize the bearer token header sent to the userInfoUri. Currently I cannot do that because ResourceServerTokenServicesConfiguration it requires that spring.oauth2.client.clientId be set.

Adding @EnableOAuth2Sso Causes A TypeNotPresentExceptionProxy Exception

I have a basic spring boot application that is using the Zuul proxy. Adding @EnableOAuth2Sso to the main class causes a TypeNotPresentExceptionProxy when starting the application. I have to add the spring security oauth dependency to my app to make things work. If that dependency is required I would expect it to be included by including the spring cloud starter security dependency but it doesn't appear to be the case.

How to override RemoteTokenServices

Hello again!

I am using @EnableOAuth2Sso functionality and as our testing/integration has moved forward it has been found that it would be best to provide our own RemoteTokenServices implementation. Right now that is being configured using ResourceServerTokenServicesConfiguration and TokenInfoServicesConfiguration gets registered. How do i register the custom implementation?

@EnableOAuth2Resource requires oauth2.client.clientId

So maybe I am missing something here. I am trying to create an API-Gateway service. It is configured with the oauth client information. I have a separate service acting as the authorization service, it configures that client (the api gateway) to be able to access multiple resources. On my resource I do not want to configure a client, just the resource id and the jwt endpoint. Yet I cant because that annotation requires a client id.

In the docs it says this:

The @EnableOAuth2Resource annotation will protect your API endpoints if you have the same environment settings as the SSO client, except that it doesn’t need a tokenUri or authorizationUri, and it also doesn’t need a clientId and clientSecret if it isn’t using the tokenInfoUri (i.e. if it has jwt.* or userInfoUri).

This implies to me that I shouldn't need it. I am thinking of the case where the resource does not have the need to act as a client at all. Once I get everything in a halfway working state I can upload an example but let me know if I am missing something here.

@EnableOauth2Resource is disabling default user for actuator endpoints

@EnableOauth2Resource annotation is disabling default security.user.
When I try to enter actuator endpoint with the user:password, it says:
o.s.s.w.a.www.BasicAuthenticationFilter : Authentication request for failed: org.springframework.security.authentication.ProviderNotFoundException: No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken

When security.user.password field is not specified, it would not log "Using default security password: ...". AuthenticationManagerConfiguration is annotated @ConditionalOnMissingBean({ AuthenticationManager.class }) & I assume ResourceServerConfiguration is registering authentication manager?

@EnableOAuth2Sso with external OAuth Provider not working

Hello,

with the current Snapshot, the @EnableOAuth2Sso is not working with e.g. Github or Facebook.

It is reproducible with the SSO sample https://github.com/spring-cloud-samples/sso. When the properties are changed to Github it fails. With 1.0.0.RC1 it is working fine.

Seems the problem only occurs with UserInfoTokenServices or SpringSocialTokenServices.

015-01-18 02:25:32.859  WARN 10419 --- [nio-9000-exec-9] o.s.web.client.RestTemplate              : POST request for "https://github.com/login/oauth/access_token" resulted in 404 (Not Found); invoking error handler
2015-01-18 02:25:32.882 DEBUG 10419 --- [nio-9000-exec-9] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
2015-01-18 02:25:32.883 ERROR 10419 --- [nio-9000-exec-9] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception

org.springframework.security.oauth2.client.resource.OAuth2AccessDeniedException: Access token denied.
    at org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport.retrieveToken(OAuth2AccessTokenSupport.java:141)
    at org.springframework.security.oauth2.client.token.grant.code.AuthorizationCodeAccessTokenProvider.obtainAccessToken(AuthorizationCodeAccessTokenProvider.java:198)
    at org.springframework.security.oauth2.client.OAuth2RestTemplate.acquireAccessToken(OAuth2RestTemplate.java:221)
    at org.springframework.security.oauth2.client.OAuth2RestTemplate.getAccessToken(OAuth2RestTemplate.java:173)
    at org.springframework.security.oauth2.client.filter.OAuth2ClientAuthenticationProcessingFilter.attemptAuthentication(OAuth2ClientAuthenticationProcessingFilter.java:91)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:211)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at demo.SsoApplication$LoginConfigurer$1.doFilterInternal(SsoApplication.java:93)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:85)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.security.oauth2.client.filter.OAuth2ClientContextFilter.doFilter(OAuth2ClientContextFilter.java:57)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.boot.actuate.autoconfigure.MetricFilterAutoConfiguration$MetricsFilter.doFilterInternal(MetricFilterAutoConfiguration.java:90)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:537)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1085)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:658)
    at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:222)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1556)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1513)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)
Caused by: org.springframework.security.oauth2.common.exceptions.OAuth2Exception: Not Found
    at org.springframework.security.oauth2.common.exceptions.OAuth2ExceptionJackson2Deserializer.deserialize(OAuth2ExceptionJackson2Deserializer.java:120)
    at org.springframework.security.oauth2.common.exceptions.OAuth2ExceptionJackson2Deserializer.deserialize(OAuth2ExceptionJackson2Deserializer.java:33)
    at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3066)
    at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2221)
    at org.springframework.http.converter.json.AbstractJackson2HttpMessageConverter.readJavaType(AbstractJackson2HttpMessageConverter.java:205)
    at org.springframework.http.converter.json.AbstractJackson2HttpMessageConverter.readInternal(AbstractJackson2HttpMessageConverter.java:192)
    at org.springframework.http.converter.AbstractHttpMessageConverter.read(AbstractHttpMessageConverter.java:159)
    at org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport$AccessTokenErrorHandler.handleError(OAuth2AccessTokenSupport.java:234)
    at org.springframework.web.client.RestTemplate.handleResponseError(RestTemplate.java:615)
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:573)
    at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:537)
    at org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport.retrieveToken(OAuth2AccessTokenSupport.java:136)
    ... 53 common frames omitted
}

Support easy customization of JWT token converter

Please see this issue for some back story, spring-attic/spring-security-oauth#366

I am needing to override which AccessTokenConverter is used when using ResourceServerTokenServicesConfiguration and JWT - it gets configured from this protected static class, inside the ResourceServerTokenServicesConfiguration, JwtTokenServicesConfiguration. My setup is this:

Spring Cloud Config Server
Spring Cloud Eureka Server
Spring Cloud Hystrix Dashboard
Spring Cloud Zuul Server

The Zuul server will manage authentication and will be used with a Keycloak cluster, using Oauth2. Each Eureka service will be an @EnableOAuth2Resource to ensure the Principle has access to the resource.

Unfortunately Keycloak JWT does have the 'aud' key and it is always just the Oauth2 client_id that is used by Keycloak. The JWT spec(https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.3) does say this about the 'aud' In the special case when the JWT has one audience, the "aud" value MAY be a single case-sensitive string containing a StringOrURI value. The interpretation of audience values is generally application specific. Use of this claim is OPTIONAL.
So the current code needs to cover the case where it is just a single string value and not an array, as currently it throws a String cannot be converted to Collection exception. It being optional, as are all the JWT fields, are what is causing the compatibility issues. Also, in an Oauth2 setup the 'aud'(audience) is a field that identifies the "resources" but not the "roles" that the principle has access to for each resource. I believe that that might be the reason for not using the 'aud' field for what really is resource access.

The JWT spec doesn't specify anything about the 'username' key - which in the Oauth2 spec it is 'username' and not 'user_name'(which is what spring security oauth2 uses). Either way i believe that the Oauth2 spec only specifies the 'username' field as a means to perform direct grant authorization. There really isn't anywhere that defines how the 'username', 'authorities', or 'roles' fields should be labeled. This means that having the ability to correctly map the JWT to what spring security expects is important for other oauth2 implementations.

I hope that i have been much more clear about the problem than the original post, which was more about how to solve a problem that wasn't defined. I appreciate the project, and the help! :)

Manage refresh tokens in OAuth2 Zuul filter

Disable Ribbon enhancements to OAuth2RestTemplate

I have a basic resource server with @EnableOAuth2Resource annotation and following configuration:

spring:
  oauth2:
    client:
      accessTokenUri: http://localhost:8080/uaa/oauth/token
      userAuthorizationUri: http://localhost:8080/uaa/oauth/authorize
      clientId: acme
      clientSecret: acmesecret
    resource:
      jwt:
        keyValue: |
          -----BEGIN PUBLIC KEY-----
          MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnGp/Q5lh0P8nPL21oMMrt2RrkT9AW5jgYwLfSUnJVc9G6uR3cXRRDCjHqWU5WYwivcF180A6CWp/ireQFFBNowgc5XaA0kPpzEtgsA5YsNX7iSnUibB004iBTfU9hZ2Rbsc8cWqynT0RyN4TP1RYVSeVKvMQk4GT1r7JCEC+TNu1ELmbNwMQyzKjsfBXyIOCFU/E94ktvsTZUHF4Oq44DBylCDsS1k7/sfZC2G5EU7Oz0mhG8+Uz6MSEQHtoIi6mc8u64Rwi3Z3tscuWG2ShtsUFuNSAFNkY7LkLn+/hxLCu2bNISMaESa8dG22CIMuIeRLVcAmEWEWH5EEforTg+QIDAQAB
          -----END PUBLIC KEY-----
      id: ${spring.application.name}
      serviceId: ${PREFIX:}resource

just a demo app, nothing fancy. I previously configured it to be a eureka client and It was throwing NullPointerException when calling another oauth2 protected resource server with OAuth2RestOperations. But when I removed the all the configs & most importantly spring-cloud-starter-eureka from the classpath, its working fine.
Here's the exception.


java.lang.NullPointerException: null
    at com.google.common.base.Preconditions.checkNotNull(Preconditions.java:210)
    at com.google.common.cache.LocalCache.get(LocalCache.java:3936)
    at com.google.common.cache.LocalCache.getOrLoad(LocalCache.java:3941)
    at com.google.common.cache.LocalCache$LocalLoadingCache.get(LocalCache.java:4824)
    at com.netflix.loadbalancer.LoadBalancerStats.getServerStats(LoadBalancerStats.java:167)
    at com.netflix.loadbalancer.LoadBalancerStats.getSingleServerStat(LoadBalancerStats.java:354)
    at com.netflix.loadbalancer.LoadBalancerContext.getServerStats(LoadBalancerContext.java:621)
    at org.springframework.cloud.netflix.ribbon.RibbonLoadBalancerClient.execute(RibbonLoadBalancerClient.java:71)
    at org.springframework.cloud.client.loadbalancer.LoadBalancerInterceptor.intercept(LoadBalancerInterceptor.java:46)
    at org.springframework.http.client.InterceptingClientHttpRequest$RequestExecution.execute(InterceptingClientHttpRequest.java:84)
    at org.springframework.http.client.InterceptingClientHttpRequest.executeInternal(InterceptingClientHttpRequest.java:69)
    at org.springframework.http.client.AbstractBufferingClientHttpRequest.executeInternal(AbstractBufferingClientHttpRequest.java:48)
    at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:53)
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:568)
    at org.springframework.security.oauth2.client.OAuth2RestTemplate.doExecute(OAuth2RestTemplate.java:128)
    at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:529)
    at org.springframework.web.client.RestTemplate.getForEntity(RestTemplate.java:261)
    at demo.FooController.relay(FooController.java:36)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:497)
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:221)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:137)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:110)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandleMethod(RequestMappingHandlerAdapter.java:777)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:706)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:943)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:877)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:966)
    at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:857)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:618)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:842)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.boot.actuate.autoconfigure.EndpointWebMvcAutoConfiguration$ApplicationContextHeaderFilter.doFilterInternal(EndpointWebMvcAutoConfiguration.java:291)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.boot.actuate.trace.WebRequestTraceFilter.doFilterInternal(WebRequestTraceFilter.java:102)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:118)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:84)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:154)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:160)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.security.oauth2.client.filter.OAuth2ClientContextFilter.doFilter(OAuth2ClientContextFilter.java:57)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.springframework.boot.actuate.autoconfigure.MetricFilterAutoConfiguration$MetricsFilter.doFilterInternal(MetricFilterAutoConfiguration.java:90)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:516)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1086)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:659)
    at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:223)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1558)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1515)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)

@EnableOAuth2Resource and securing sub-set of resources

I have a pretty straightforward Spring Boot app with an API resource I would like to protect with OAuth2.

In my POM I have added the spring-cloud-starter-security dependency. I have a class annotated with @RestController and @EnableOAuth2Resource. In my application.properties I have added

oauth2.resource.userInfoUri=https://api.github.com/user
oauth2.resource.preferTokenInfo=false

When I start the app and hit the API endpoints they do not appear to be protected, I am getting back 200s without supplying an access token in the request.

Am I missing another part of the configuration?

How to get a client_credentials token for doing behind the scenes calls

If I inject the the bean registered as oAuth2RestTemplate it will pass on the user token.

If I want to pass on a client_credential would it be correct to do this?

@Bean
@ConfigurationProperties("spring.oauth2.client")
public ClientCredentialsResourceDetails oauth2ClientCredentialsResourceDetails() {
    ClientCredentialsResourceDetails details = new ClientCredentialsResourceDetails();
    return details;
}

@Bean
public OAuth2RestTemplate clientCredentialsRestTemplate(OAuth2ClientContext oauth2ClientContext, ClientCredentialsResourceDetails details) {
    OAuth2RestTemplate template = new OAuth2RestTemplate(details, oauth2ClientContext);
    return template;
}

Maybe we should add a section in the docs about machine to machine communication and how to do that with feign or with RestTemplate?

Documentation or examples for security with proxy

See original discussion in #14.

I think if the Zuul proxy somehow knew about the security routes from the resource it is proxying from that would be ideal. That way the configuration stays with the resource and if the resource is accessed without using the proxy the security routes are still in place.

How to provide custom redirect_uri when using @EnableOAuth2Sso

Hello,

I am using the OAuth2 module and Spring Cloud Zuul to proxy service requests. The plan would be to have Zuul redirect to the Authorization Server using a redirect_uri of the previous request. However, due to the Spring Security redirect to /login I always get sent back to login. In a perfect world the redirect uri would be the original request to the Zuul Proxy. Is there a way to provide this functionality?

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.