Error handling for Spring Security Resource Server

 1// src/main/java/dev/mflash/guides/tokenval/introspection/security/SecurityConfiguration.java
 2
 3@EnableWebSecurity
 4public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 5
 6  protected @Override void configure(HttpSecurity http) throws Exception {
 7    http.authorizeRequests()
 8        // other configurations
 9        .and().oauth2ResourceServer()
10        .authenticationEntryPoint(new CustomOAuth2AuthenticationEntryPoint())
11        .accessDeniedHandler(new CustomOAuth2AccessDeniedHandler())
12        .opaqueToken();
13  }
14
15  // rest of the implementation
16}

 1public class CustomOAuth2AuthenticationEntryPoint implements AuthenticationEntryPoint {
 2
 3  private static final Logger logger = LoggerFactory.getLogger(CustomOAuth2AuthenticationEntryPoint.class);
 4
 5  private String realmName;
 6
 7  @Override
 8  public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e)
 9      throws IOException {
10    logger.error(e.getLocalizedMessage(), e);
11
12    HttpStatus status = HttpStatus.UNAUTHORIZED;
13    String errorMessage = "Insufficient authentication details";
14    Map<String, String> parameters = new LinkedHashMap<>();
15
16    if (Objects.nonNull(realmName)) {
17      parameters.put("realm", realmName);
18    }
19
20    if (e instanceof OAuth2AuthenticationException) {
21      OAuth2Error error = ((OAuth2AuthenticationException) e).getError();
22      parameters.put("error", error.getErrorCode());
23
24      if (StringUtils.hasText(error.getDescription())) {
25        errorMessage = error.getDescription();
26        parameters.put("error_description", errorMessage);
27      }
28
29      if (StringUtils.hasText(error.getUri())) {
30        parameters.put("error_uri", error.getUri());
31      }
32
33      if (error instanceof BearerTokenError) {
34        BearerTokenError bearerTokenError = (BearerTokenError) error;
35
36        if (StringUtils.hasText(bearerTokenError.getScope())) {
37          parameters.put("scope", bearerTokenError.getScope());
38        }
39
40        status = ((BearerTokenError) error).getHttpStatus();
41      }
42    }
43
44    String message = RestResponse.builder()
45        .status(status)
46        .error("Unauthenticated")
47        .message(errorMessage)
48        .path(request.getRequestURI())
49        .json();
50
51    String wwwAuthenticate = computeWWWAuthenticateHeaderValue(parameters);
52    response.addHeader("WWW-Authenticate", wwwAuthenticate);
53    response.setStatus(status.value());
54    response.setContentType(MediaType.APPLICATION_JSON_VALUE);
55    response.getWriter().write(message);
56  }
57}

 1public final class WWWAuthenticateHeaderBuilder {
 2
 3  public static String computeWWWAuthenticateHeaderValue(Map<String, String> parameters) {
 4    StringJoiner wwwAuthenticate = new StringJoiner(", ", "Bearer ", "");
 5
 6    if (!parameters.isEmpty()) {
 7      parameters.forEach((k, v) -> wwwAuthenticate.add(k + "=\"" + v + "\""));
 8    }
 9
10    return wwwAuthenticate.toString();
11  }
12}

 1public class CustomOAuth2AccessDeniedHandler implements AccessDeniedHandler {
 2
 3  public static final Logger logger = LoggerFactory.getLogger(CustomOAuth2AccessDeniedHandler.class);
 4
 5  private String realmName;
 6
 7  @Override
 8  public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException e)
 9      throws IOException {
10    logger.error(e.getLocalizedMessage(), e);
11
12    Map<String, String> parameters = new LinkedHashMap<>();
13    String errorMessage = e.getLocalizedMessage();
14
15    if (Objects.nonNull(realmName)) {
16      parameters.put("realm", realmName);
17    }
18
19    if (request.getUserPrincipal() instanceof AbstractOAuth2TokenAuthenticationToken) {
20      errorMessage = "The request requires higher privileges than provided by the access token.";
21
22      parameters.put("error", "insufficient_scope");
23      parameters.put("error_description", errorMessage);
24      parameters.put("error_uri", "https://tools.ietf.org/html/rfc6750#section-3.1");
25    }
26
27    String message = RestResponse.builder()
28        .status(HttpStatus.FORBIDDEN)
29        .message(errorMessage)
30        .path(request.getRequestURI())
31        .json();
32
33    String wwwAuthenticate = computeWWWAuthenticateHeaderValue(parameters);
34    response.addHeader("WWW-Authenticate", wwwAuthenticate);
35    response.setStatus(HttpStatus.FORBIDDEN.value());
36    response.setContentType(MediaType.APPLICATION_JSON_VALUE);
37    response.getWriter().write(message);
38  }
39
40  public void setRealmName(String realmName) {
41    this.realmName = realmName;
42  }
43}