title: Spring Boot Security OAuth2 with Form Login
body: <p>I am following <a href="https://spring.io/guides/tutorials/spring-security-and-angular-js/#_sso_with_oauth2_angular_js_and_spring_security_part_v" rel="noreferrer">Part V of Getting Started with Spring Boot Security</a> to secure my RESTful microservices.</p>
  
  <p>The simple flow that I intend to implement is:-</p>
  
  <ol>
  <li><p>If unauthenticated, the user is redirected to a custom login page at
  say '/login'.</p></li>
  <li><p>User provides his credentials.</p></li>
  <li><p>On successful authentication user is redirected to home page
  ('/home'). I should be able to access my REST endpoint (behind a
  Zuul Proxy Server) after providing the access token in the request.</p></li>
  </ol>
  
  <p>The Getting Started guide in the above mentioned link uses Basic Auth and dummy user configured in .properties or .yml file.</p>
  
  <p>This is how I tried with my configuration:-</p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class OAuth2Config extends AuthorizationServerConfigurerAdapter {
  
      @Autowired
      private AuthenticationManager authenticationManager;
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
          endpoints.authenticationManager(authenticationManager);
      }
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory().withClient("acme").secret("acmesecret")
                  .authorizedGrantTypes("authorization_code", "refresh_token", "password").scopes("openid")
                  .accessTokenValiditySeconds(3600);
      }
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
          oauthServer.tokenKeyAccess("isAnonymous()").checkTokenAccess("isAnonymous()")
                  .allowFormAuthenticationForClients();
      }
  
  }
  
  
  
  @Configuration
  @Import({ OptoSoftSecurityServiceConfig.class })
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private UserDetailsService userDetailsService; // backed by MongoDB
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userDetailsService);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.httpBasic().disable().formLogin();// disabled basic auth and configured to use dafault Spring Security form login.
      }
  }
  </code></pre>
  
  <p>Hitting the <a href="http://localhost:9999/uaa/oauth/authorize?response_type=code&amp;client_id=acme&amp;redirect_uri=http://example.com" rel="noreferrer">authorization endpoint</a> redirects me to '<a href="http://localhost:9999/uaa/login" rel="noreferrer">http://localhost:9999/uaa/login</a>' with error message as:-</p>
  
  <pre><code>&lt;oauth&gt;
  &lt;error_description&gt;
  Full authentication is required to access this resource
  &lt;/error_description&gt;
  &lt;error&gt;unauthorized&lt;/error&gt;
  &lt;/oauth&gt;
  </code></pre>
  
  <p><strong>PROBLEM</strong></p>
  
  <ol>
  <li><p>How can I configure Authorization Server to use UserDetailsService
  instead of static user and use Form Login instead of Basic Auth.</p></li>
  <li><p>How can I configure Auto Approval while using 'authorization_code'
  as the grant type?</p></li>
  <li><p>Is it mandatory for /oauth/authorize endpoint to be protected by
  Basic Auth? Why 'Full authentication is required' to access the
  /oauth/authorize' endpoint. I believe we do not know who is the user
  before this endpoint. The user can only be identified once he has
  been authenticated using valid credentials which comes after form
  login.</p></li>
  </ol>