Client Registration with Spring-boot Oauth2 - tokenUri vs issuerUri

Question

Sorry folks, this may be a newb question. I'm a little lost.

My Spring-boot environment provides me with keycloak for client authorization, it gives me these.

spring.security.oauth2.resourceserver.jwt.issuer-uri
spring.security.oauth2.client.provider.keycloak.issuer-uri
spring.security.oauth2.client.registration.keycloak.* # client-id, secret, provider, grant-type

I noticed on the ClientRegistration that .issuerUri(String uri) is not avaialbe until Spring-Security v5.4.x. I am using 5.3.5, although I could bump up. I am confused what the difference is. As I would expect, I get an error when I do .tokenUri(issuerUri). I believe they are different modes/API, but I am at a loss as to what I should set in the 5.3.5 API.

Caused by: org.springframework.security.oauth2.client.ClientAuthorizationException: [invalid_token_response] An error occurred while attempting to retrieve the OAuth 2.0 Access Token Response: 405 Method Not Allowed: [{"error":"RESTEASY003650: No resource method found for POST, return 405 with Allow header"}]

So as a newb, I don't get why I have 4 choices of URI and what they do. Google and javadoc haven't been much help, so I figure I just don't know the right place to look to learn it. The only way I know how to fix this is to manual make my own HTTP call to the URI and get my Authentication token, but that would defeat the purpose of the Oauth2 library.

Answer 1

tokenUri represents the URI for the token endpoint. For example:

https://authz.example.org/auth/realms/myrealms/protocol/openid-connect/token

Whereas issuerUri is the URI that identifies the Authorization Server:

https://authz.example.org/auth

It's quite common for the issuer URI to be the root for more specific URIs like the token URI.

Regarding your specific error, I'd imagine that Keycloak is stating that you cannot POST to https://authz.example.org/auth, which is true. You should be POSTing to the token endpoint.

The issuer-uri Spring Boot property should cause Spring Security to look up the other endpoints and add them to a default ClientRegistration. Because of that, I'm not sure why you are also trying to programmatically configure ClientRegistration. That said, if you do need to programmatically create a ClientRegistration, you can use the issuer URI like so, and Spring Security will do the rest:

@Bean
ClientRegistrationRepository registrations() {
    ClientRegistration registration = ClientRegistrations
            .forIssuerLocation("https://authz.example.org/auth")
            .build();
    return new InMemoryClientRegistrationRepository(registration);
}