Spring Oauth2 with custom url and signature asymmetric signature

I am very new to oauth and especially spring oauth2. Using basic spring oauth basic authentication it’s success.
Now I want to custom url and authentication method:

curl –location ‘http://localhost:27113/api/token/b2b
X-TIMESTAMP : DateTime with timezone, which follows the ISO-8601 standard
X-CLIENT-KEY : client_id
X-SIGNATURE : Signature Asymmetric
Content-Type : application/json
{
“grantType”: “client_credentials”
}

=================================

Signature asymmetric :

Generate Signature Asymmetric

SHA256withRSA is used to generate the signature with your Private Key as the key
X-SIGNATURE = SHA256withRSA(PrivateKey, StringToSign)

Note = X-SIGNATURE should be encoded by Base64

The StringToSign will be a colon-separated list derived from some request data as below :
StringToSign = client_ID+”|”+X-TIMESTAMP

///AuthorizationServiceConfigurerAdapterImpl.java

public class AuthorizationServiceConfigurerAdapterImpl extends AuthorizationServerConfigurerAdapter{

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private TokenStore JdbcTokenStore;

    @Autowired
    private DataSource dataSource;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients)
            throws Exception {
        clients.jdbc(dataSource);
        //.inMemory().withClient("test").accessTokenValiditySeconds(3600);
    }

    @Override
    public void configure(
            AuthorizationServerEndpointsConfigurer endpoints)
            throws Exception {

        endpoints
                .tokenStore(JdbcTokenStore)
                .pathMapping("/oauth/token"             , "/api/oauth/token")
                .pathMapping("/oauth/authorize"         , "/api/oauth/authorize")
                .pathMapping("/oauth/check_token"      , "/api/oauth/check_token")
                .pathMapping("/oauth/confirm_access"   , "/api/oauth/confirm_access")
                .pathMapping("/oauth/error"               , "/api/oauth/error")
                .pathMapping("/oauth/token"              , "/api/oauth/token")
                .authenticationManager(authenticationManager);

        endpoints.addInterceptor((HandlerInterceptor) new SignatureVerificationFilter())
        //endpoints.addInterceptor(new SignatureVerificationInterceptor())
                .pathMapping("/oauth/token", "/api/token/b2b");                
    }
    
    @Bean
    public FilterRegistrationBean filterRegistrationBean() throws Exception {
        FilterRegistrationBean registrationBean = new FilterRegistrationBean();
        SignatureVerificationFilter securityFilter = new SignatureVerificationFilter(publicKey());
        registrationBean.setFilter(securityFilter);
        registrationBean.addUrlPatterns("/api/token/b2b");
        registrationBean.setOrder(1);
    
        return registrationBean;
    }

    @Bean
    public PublicKey publicKey() throws Exception {
        return loadPublicKey();
    }
}

///SignatureVerificationFilter.java

public class SignatureVerificationFilter extends OncePerRequestFilter {
    @Autowired
    private SignatureVerificationService signatureVerificationService;
    private PublicKey publicKey;


    
    public SignatureVerificationFilter(PublicKey publicKey) {
        // TODO Auto-generated constructor stub
        this.publicKey = publicKey;
    }

    public SignatureVerificationFilter() {
        // TODO Auto-generated constructor stub
    }

    //@Override
    protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
        return request.getHeader("X-CLIENT-KEY");
    }

    //@Override
    protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
        return request.getHeader("X-SIGNATURE");
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        String clientId = request.getHeader("X-CLIENT-KEY");
        String timestamp = request.getHeader("X-TIMESTAMP");
        String signature = request.getHeader("X-SIGNATURE");

        try {
            if (!signatureVerificationService.verifySignature(clientId, timestamp, signature)) {
                throw new AuthenticationException("Invalid signature") {

                    private static final long serialVersionUID = 1L;};
            }
            filterChain.doFilter(request, response);
        } catch (Exception e) {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            response.setContentType("application/json");
            response.getWriter().write("{"responseCode":"4017300","responseMessage":"Unauthorized. [Signature]"}");
        }
    }
}

//SignatureVerificationService.java

public class SignatureVerificationService {

    @Autowired
    private ClientDetailsRepository clientDetailsRepository;

    public boolean verifySignature(String clientId, String timestamp, String signature) throws JOSEException, ParseException {
        ClientDetails client = clientDetailsRepository.findByClientId(clientId);
        if (client == null) {
            return false;
        }

        String stringToSign = clientId + "|" + timestamp;

        // Base64 decode the signature
        byte[] decodedSignature = Base64.getDecoder().decode(signature);

        // Create JWSObject to represent the JWT
        JWSObject jwsObject = JWSObject.parse(new String(decodedSignature));


        // Parse the public key stored in the database
        RSAPublicKey publicKey = (RSAPublicKey) RSAKey.parse(client.getPublicKey()).toPublicKey();

        // Create an RSASSAVerifier with the public key
        RSASSAVerifier verifier = new RSASSAVerifier(publicKey);

        // Verify the signature
        return jwsObject.verify(verifier) && jwsObject.getPayload().toString().equals(stringToSign);
    }
}

All credentials: public key, and private key is correct. But it’s got error:
2024-08-12 15:14:54,809 DEBUG org.springframework.security.web.util.matcher.AntPathRequestMatcher [http-nio-27113-exec-6] Checking match of request : ‘/api/token/b2b’; against ‘/api/token/b2b’
2024-08-12 15:14:54,810 DEBUG org.springframework.security.access.intercept.AbstractSecurityInterceptor [http-nio-27113-exec-6] Secure object: FilterInvocation: URL: /api/token/b2b; Attributes: [fullyAuthenticated]
2024-08-12 15:14:54,810 DEBUG org.springframework.security.access.intercept.AbstractSecurityInterceptor [http-nio-27113-exec-6] Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
2024-08-12 15:14:54,810 DEBUG org.springframework.security.access.vote.AffirmativeBased [http-nio-27113-exec-6] Voter: org.springframework.security.web.access.expression.WebExpressionVoter@4866e6fa, returned: -1
2024-08-12 15:14:54,810 DEBUG org.springframework.security.web.access.ExceptionTranslationFilter [http-nio-27113-exec-6] Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84)
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)

All credentials: public key, and private key is correct. But it’s got error:
2024-08-12 15:14:54,809 DEBUG org.springframework.security.web.util.matcher.AntPathRequestMatcher [http-nio-27113-exec-6] Checking match of request : ‘/api/token/b2b’; against ‘/api/token/b2b’
2024-08-12 15:14:54,810 DEBUG org.springframework.security.access.intercept.AbstractSecurityInterceptor [http-nio-27113-exec-6] Secure object: FilterInvocation: URL: /api/token/b2b; Attributes: [fullyAuthenticated]
2024-08-12 15:14:54,810 DEBUG org.springframework.security.access.intercept.AbstractSecurityInterceptor [http-nio-27113-exec-6] Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
2024-08-12 15:14:54,810 DEBUG org.springframework.security.access.vote.AffirmativeBased [http-nio-27113-exec-6] Voter: org.springframework.security.web.access.expression.WebExpressionVoter@4866e6fa, returned: -1
2024-08-12 15:14:54,810 DEBUG org.springframework.security.web.access.ExceptionTranslationFilter [http-nio-27113-exec-6] Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84)
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)

New contributor

justsun is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

Trang chủ Giới thiệu Sinh nhật bé trai Sinh nhật bé gái Tổ chức sự kiện Biểu diễn giải trí Dịch vụ khác Trang trí tiệc cưới Tổ chức khai trương Tư vấn dịch vụ Thư viện ảnh Tin tức - sự kiện Liên hệ Chú hề sinh nhật Trang trí YEAR END PARTY công ty Trang trí tất niên cuối năm Trang trí tất niên xu hướng mới nhất Trang trí sinh nhật bé trai Hải Đăng Trang trí sinh nhật bé Khánh Vân Trang trí sinh nhật Bích Ngân Trang trí sinh nhật bé Thanh Trang Thuê ông già Noel phát quà Biểu diễn xiếc khỉ Xiếc quay đĩa Dịch vụ tổ chức sự kiện 5 sao Thông tin về chúng tôi Dịch vụ sinh nhật bé trai Dịch vụ sinh nhật bé gái Sự kiện trọn gói Các tiết mục giải trí Dịch vụ bổ trợ Tiệc cưới sang trọng Dịch vụ khai trương Tư vấn tổ chức sự kiện Hình ảnh sự kiện Cập nhật tin tức Liên hệ ngay Thuê chú hề chuyên nghiệp Tiệc tất niên cho công ty Trang trí tiệc cuối năm Tiệc tất niên độc đáo Sinh nhật bé Hải Đăng Sinh nhật đáng yêu bé Khánh Vân Sinh nhật sang trọng Bích Ngân Tiệc sinh nhật bé Thanh Trang Dịch vụ ông già Noel Xiếc thú vui nhộn Biểu diễn xiếc quay đĩa Dịch vụ tổ chức tiệc uy tín Khám phá dịch vụ của chúng tôi Tiệc sinh nhật cho bé trai Trang trí tiệc cho bé gái Gói sự kiện chuyên nghiệp Chương trình giải trí hấp dẫn Dịch vụ hỗ trợ sự kiện Trang trí tiệc cưới đẹp Khởi đầu thành công với khai trương Chuyên gia tư vấn sự kiện Xem ảnh các sự kiện đẹp Tin mới về sự kiện Kết nối với đội ngũ chuyên gia Chú hề vui nhộn cho tiệc sinh nhật Ý tưởng tiệc cuối năm Tất niên độc đáo Trang trí tiệc hiện đại Tổ chức sinh nhật cho Hải Đăng Sinh nhật độc quyền Khánh Vân Phong cách tiệc Bích Ngân Trang trí tiệc bé Thanh Trang Thuê dịch vụ ông già Noel chuyên nghiệp Xem xiếc khỉ đặc sắc Xiếc quay đĩa thú vị
Trang chủ Giới thiệu Sinh nhật bé trai Sinh nhật bé gái Tổ chức sự kiện Biểu diễn giải trí Dịch vụ khác Trang trí tiệc cưới Tổ chức khai trương Tư vấn dịch vụ Thư viện ảnh Tin tức - sự kiện Liên hệ Chú hề sinh nhật Trang trí YEAR END PARTY công ty Trang trí tất niên cuối năm Trang trí tất niên xu hướng mới nhất Trang trí sinh nhật bé trai Hải Đăng Trang trí sinh nhật bé Khánh Vân Trang trí sinh nhật Bích Ngân Trang trí sinh nhật bé Thanh Trang Thuê ông già Noel phát quà Biểu diễn xiếc khỉ Xiếc quay đĩa
Thiết kế website Thiết kế website Thiết kế website Cách kháng tài khoản quảng cáo Mua bán Fanpage Facebook Dịch vụ SEO Tổ chức sinh nhật