separate AuthorizationServer from ResourceServer(single sign-on) about spring-rest-service-oauth HOT 5 CLOSED

authorization server issues token, resource server provides access to resource based on that token but it has to have a way to validate it to confirm it is the token issued by authorization server, in royclarkson's example tokens are stored in memory private TokenStore tokenStore = new InMemoryTokenStore(); by authentication server but it is within same application, when dealing with separated implementation on more hosts, you have to have a way to check from resource server against the tokenstore in authentication server, how you establish communication when both are on separate hosts and validate token is up to you and it is probably way beyond the scope of this example, but it should not be that hard ResourceServerSecurityConfigurer allows you to implement your own approach when verifying token

from spring-rest-service-oauth.

@mariubog , thanks for your answer!

Please let me summarize - I have two application - first is oauth2 AuthorizationServer(my SSO point) and the second application is some business REST service API. So, based on this example, I need to move implementation of ResourceServerConfiguration from first to my second application and implement some kind of shared TokenStore for both of them, for example based on persistent database ?

from spring-rest-service-oauth.

whichever endpoints you want to secure with oauth thats where your resource server has to be, in you case REST endpoints, yes probably some kind of database and than provide secure endpoint to access that database and verify that token is valid, I have not done it but would suggest to take good look at both AuthorizationServerEndpointsConfigurer and ResourceServerSecurityConfigurer they offer some api to make lot of customizations, though communication will be still the part that is left to your own implementation

from spring-rest-service-oauth.

@mariubog , thanks !

from spring-rest-service-oauth.

@mariubog thanks for the information! Agreed that it is beyond scope of this example.

from spring-rest-service-oauth.