Currently I’m migrating Spring Boot 2.7 to Spring Boot 3.3 and I have done almost all except OAuth security what seems to be very different in 3.3 then in 2.7.
Since we have a lot of different clients and also legacy data, things should have no change on the API. Clients should transparently be able to get their access and request tokens as well as refresh tokens and use them as is.
Now I realized the former OAuth Authorization Server was mapped to /oauth path. The token request endpoint, for example, was on /oauth/token.
The new OAuth Authorization Server has changed that to /oauth2. The token request endpoint for example is now on /oauth2/token and clients are not able to get tokens any more.
I didn’t find any description of how to map the new Authorization Server endpoints to /oauth instead of /oauth2. Is there any way to do so?
Or is there a way to route all request on /oauth to /oauth2 in Spring Boot 3?
Tried to find any help online for mapping new Spring Boot OAuth Authorization Server to old endpoints.
Tried to apply an Http forward mapping:
@RequestMapping(path = "/oauth/token")
public void oauthForwardToOauth2(final HttpServletResponse response) {
try {
response.sendRedirect(serviceInfo.getExternalServiceURI() + "/oauth2/token/");
} catch (IOException e) {
throw new RuntimeException(e);
}
}
But this was not working and gives a 404 back. It seems like the request id forwarded as GET insted as POST request.
Thanks
2
I was able to find the proper solution to this within an example. Just use AuthorizationServerSettings and expose it as a Bean.
@Bean
public AuthorizationServerSettings authorizationServerSettings() {
return AuthorizationServerSettings
.builder()
.tokenEndpoint("/oauth/token")
.tokenRevocationEndpoint("/oauth/revoke-token")
.build();
}
This worked as expected, and it is possible to also set other related endpoints the same way.