# Add support for OAuth 2.0 to Flowable's REST APIs

**URL:** <https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239>\
**Category:** Flowable Engine\
**Created:** [January 15, 2020, 3:21am UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239 "2020-01-15T03:21:23Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robinyo](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Robinyo](https://forum.flowable.org/u/Robinyo)\
**Post date:** [January 15, 2020, 3:21am UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239/1 "2020-01-15T03:21:23Z")

</div>

Contemporary application’s use OpenID Connect for Authentication and OAuth 2.0 (scopes and claims) for Authorization.

**Describe the solution you’d like**  
Add support for OAuth 2.0 to Flowable’s REST APIs.

See:

- [Support Basic Auth and Spring OAuth 2.0](https://stackoverflow.com/questions/23526644/spring-security-with-oauth2-or-http-basic-authentication-for-the-same-resource)
- [Securing your REST API using Keycloak and Spring OAuth2](https://medium.com/@bcarunmail/securing-rest-api-using-keycloak-and-spring-oauth2-6ddf3a1efcc2)

**Describe alternatives you’ve considered**  
Currently, Flowable only supports Basic Auth.

See: [https://github.com/flowable/flowable-engine/issues/660#issue-274448784](https://github.com/flowable/flowable-engine/issues/660#issue-274448784)

**Additional context**  
See: [Flowable Issues - 2126](https://github.com/flowable/flowable-engine/issues/2126)

---

<div class="post-metadata">

**Author:** ![joram](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/joram/32/26_2.png) [@joram](https://forum.flowable.org/u/joram)\
**Post date:** [January 17, 2020, 3:43pm UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239/2 "2020-01-17T15:43:18Z")

</div>

I agree it’s nice to have, but it’s currently not on our roadmap. Or are you thinking about a contribution (with which we can assist of course)?

---

<div class="post-metadata">

**Author:** ![Robinyo](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Robinyo](https://forum.flowable.org/u/Robinyo)\
**Post date:** [January 31, 2020, 6:52am UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239/3 "2020-01-31T06:52:01Z")

</div>

@joram

I’ve had a look at Spring Security’s support for OAuth 2.0.

```auto
git clone https://github.com/spring-projects/spring-security.git

```

Build:

```auto
cd ~/spring-security/samples/boot/oauth2resourceserver
gradle clean build

```

Run:

```auto
java -jar ./build/libs/spring-security-samples-boot-oauth2resourceserver-5.3.0.BUILD-SNAPSHOT.jar

```

The [hard coded](https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2resourceserver) tokens work as expected.

I updated the `application.yml` to point to my [Authorization Server](https://robferguson.org/blog/2019/12/24/getting-started-with-keycloak/) (Keycloak):

```auto
spring:
  main:
    banner-mode: "off" 

---
logging:
  level: 
    root: INFO 

---
logging:
  level:
    org.springframework.security: DEBUG

---
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri: http://localhost:10001/auth/realms/development/protocol/openid-connect/certs

```

curl [http://localhost:10001/auth/realms/development/protocol/openid-connect/certs](http://localhost:10001/auth/realms/development/protocol/openid-connect/certs)

```auto
{
    "keys": [
        {
            "kid": "Zzq49qnky3j2seAxDtRsJU0QdUj4cfMhw44QlDcBAi8",
            "kty": "RSA",
            "alg": "RS256",
            "use": "sig",
            "n": "jLZBNwKjf6-ENABVI_mkhcwlwbs5DIEP6o4zvlM2GpSiSCEgP9No-irYPeP5tugbXyeQGKmqUkmNBfVjqUMxVgG7_zmqfgsABMEkwWhgFfFoGa0jjN43wsDV7nqLs3erQkSB81vyuFq0fXvTWwwXny0v11IcR2OWmPENzPzgNb194JoODuNInW9ymt6TTaV0BvLNGAj3_8W3_WijUfZuudxdkZ00ciwJrjAJ-5Bz4DRaBCB64EZc5A1DtbSWgpftZtOjRX5_CAVctZnV0bxZad2h7e4df98Mla0S15b79TjCFywAXOlBqDqFL8sNQZR9nbrYo0qtvPsViaAbpj2Fsw",
            "e": "AQAB",
            "x5c": [
                "MIICmzCCAYMCBgFvIWexnTANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZtYXN0ZXIwHhcNMTkxMjIwMDM0MjIxWhcNMjkxMjIwMDM0NDAxWjARMQ8wDQYDVQQDDAZtYXN0ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCMtkE3AqN/r4Q0AFUj+aSFzCXBuzkMgQ/qjjO+UzYalKJIISA/02j6Ktg94/m26BtfJ5AYqapSSY0F9WOpQzFWAbv/Oap+CwAEwSTBaGAV8WgZrSOM3jfCwNXueouzd6tCRIHzW/K4WrR9e9NbDBefLS/XUhxHY5aY8Q3M/OA1vX3gmg4O40idb3Ka3pNNpXQG8s0YCPf/xbf9aKNR9m653F2RnTRyLAmuMAn7kHPgNFoEIHrgRlzkDUO1tJaCl+1m06NFfn8IBVy1mdXRvFlp3aHt7h1/3wyVrRLXlvv1OMIXLABc6UGoOoUvyw1BlH2dutijSq28+xWJoBumPYWzAgMBAAEwDQYJKoZIhvcNAQELBQADggEBADMNWMWqzFcfMbNcyCSRsI+GmjVSnvEHR7lrAGZJjnqN2MIKN1cHYPfzzxqvkfWODJIyGsO25Tw+sNiFlg1f+o+dh3Szh2T+3ZLiC8VLT+bhdDOjvAaGomRzZC4haYIs8jzJb2p9y9+5pqk/TvUaoJLWrSuBUNxPj6paYmiksP88NWvWO35SRAq5o8G7XuZE4UCJK0ytqPpiasDFOfDS6nASuZEy2/s4RtDFeTt04oaW6EHOjcCv7vDtGHyi8o34sr1iKT/zYs298yniJdI7sHhwzDs2y77+/LOWT5D8Xtma8T9449cla7XxfQhUNKmSRvdhI3pn7s4lm5D5YEx3+QY="
            ],
            "x5t": "srWjtAz9zfU3P4QEQ8scY3Aft4Y",
            "x5t#S256": "SRhwmA6NSKFv8gFL1Jk-q--ew69oAl8Bl7Ik3QFl7xM"
        }
    ]
}

```

I rebuilt the sample:

```auto
gradle clean build -x test -x integrationTest

```

Run:

```auto
java -jar ./build/libs/spring-security-samples-boot-oauth2resourceserver-5.3.0.BUILD-SNAPSHOT.jar

```

I used Postman to obtain a valid token from Keycloak:

 ![Screen Shot 2020-01-31 at 16.52.59](https://canada1.discourse-cdn.com/flex035/uploads/flowable/original/2X/a/a2cd55999fca5620f50e4b652354fd5ff61054b3.png)

And, it worked 🙂

I then created my own sample [REST API](https://github.com/Robinyo/serendipity-api/tree/master/projects/spring-boot) ([using Spring Boot, JPA, HATEOAS, Spring Security, …](https://github.com/Robinyo/serendipity-api/blob/master/projects/spring-boot/pom.xml)).

See:

- [OAuth2ResourceServerSecurityConfiguration.java](https://github.com/Robinyo/serendipity-api/blob/master/projects/spring-boot/server/src/main/java/org/serendipity/restapi/config/OAuth2ResourceServerSecurityConfiguration.java)
- [IndividualController.java](https://github.com/Robinyo/serendipity-api/blob/master/projects/spring-boot/server/src/main/java/org/serendipity/restapi/controller/IndividualController.java)

It seems pretty straight forward to add support for OAuth 2.0 JWT access tokens.

---

<div class="post-metadata">

**Author:** ![Robinyo](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Robinyo](https://forum.flowable.org/u/Robinyo)\
**Post date:** [February 4, 2020, 12:49am UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239/4 "2020-02-04T00:49:00Z")

</div>

@joram

I’ve also had a look at the [Flowable Spring Boot Starters](https://github.com/flowable/flowable-engine/tree/master/modules/flowable-spring-boot/flowable-spring-boot-starters).

For example ([pom.xml](https://github.com/Robinyo/serendipity-api/blob/master/projects/spring-boot/pom.xml)):

```auto
    <!-- Add Flowable dependencies -->
  
    <dependency>
      <groupId>org.flowable</groupId>
      <artifactId>flowable-spring-boot-starter-process-rest</artifactId>
      <version>${flowable.version}</version>
    </dependency>
    
    <dependency>
      <groupId>org.flowable</groupId>
      <artifactId>flowable-ldap</artifactId>
      <version>${flowable.version}</version>
    </dependency>

```

Which works as expected:

 ![Screen Shot 2020-02-04 at 11.47.04](https://canada1.discourse-cdn.com/flex035/uploads/flowable/original/2X/6/61801f409f099a3569c7cd4943fcb2c173b3ee93.png)

H2 console:

 ![Screen Shot 2020-02-04 at 11.50.12](https://canada1.discourse-cdn.com/flex035/uploads/flowable/original/2X/8/80edb57596a6bab2a8aeaf0a65b64c6318e8dcf2.png)

---

<div class="post-metadata">

**Author:** ![joram](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/joram/32/26_2.png) [@joram](https://forum.flowable.org/u/joram)\
**Post date:** [February 4, 2020, 8:42pm UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239/5 "2020-02-04T20:42:10Z")

</div>

Wow, that’s amazing work. So basically you’ve got the starters + JWT pretty much going? Planning to write a blog about it 😃?

---

<div class="post-metadata">

**Author:** ![Robinyo](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Robinyo](https://forum.flowable.org/u/Robinyo)\
**Post date:** [February 5, 2020, 1:18am UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239/6 "2020-02-05T01:18:23Z")

</div>

@joram

See: [Flowable OAuth2 Resource Server](https://robferguson.org/blog/2020/02/05/flowable-oauth2-resource-server/)

---

<div class="post-metadata">

**Author:** ![tommy](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/tommy/32/1438_2.png) [@tommy](https://forum.flowable.org/u/tommy)\
**Post date:** [May 22, 2020, 2:16am UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239/7 "2020-05-22T02:16:55Z")

</div>

Thank for good blog.  
But with authentication resource server we only wrap flowable rest into spring.  
We can’t using this user information for identity service. same as log user when finish task…  
How to change httpBasic (which support default by flowable) to AuthenticationResource without change root code

---

<div class="post-metadata">

**Author:** ![joram](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/joram/32/26_2.png) [@joram](https://forum.flowable.org/u/joram)\
**Post date:** [May 26, 2020, 8:13pm UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239/8 "2020-05-26T20:13:07Z")

</div>

That would need some changes indeed - however Flowable is using Spring Security behind the scenes, so all changes should be properly documented in the Spring Boot docs.

---

<div class="post-metadata">

**Author:** ![tommy](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/tommy/32/1438_2.png) [@tommy](https://forum.flowable.org/u/tommy)\
**Post date:** [June 18, 2020, 1:15am UTC](https://forum.flowable.org/t/add-support-for-oauth-2-0-to-flowables-rest-apis/5239/9 "2020-06-18T01:15:27Z")

</div>

yes. I agree with Joram about it.  
Because we can add your filter and provider for your security.

From adapter we can use AuthenticationContext for get user info.  
It is a way for get user info when we use other security system.