Initial config hacking
NOJIRA More pounding on config.

Left off with requests hitting the OAuth filter but not the authZ
service. Think the latter needs to be moved into the child app
context that actually has our DispatchServlet
NOJIRA Upgrade SpringSecurity in test config
NOJIRA Oauth2 client auth and traditional uP auth now both work

Next steps:

  - SspUser-integrated read-only ClientDetailsUserDetailsService - we need to
    convert Oauth Clients to SspUsers and SspUsers must be linked to
    Persons in order for our audit trails to work. Right now we're just
    getting vanilla SpringSecurity User objects which our
    SecurityService doesn't know what to do with. I think the right
    thing to do is to perform the conversion in the Oauth
    UserDetailsService, else SecurityServiceImpl needs to change
    every time we add a new authentication mechanism. If we need to
    subclass SspUser to retain client information that's fine.

  - Database backed ClientDetailsUserDetailsService - Take a look at
    JdbcClientDetailsServices... no sense in inventing our own.

  - SSP write extensions to ClientDetailsUserDetailsService... we need
    a REST API on top of this for managing ClientDetails. Think it
    belongs with the standard read-only stuff b/c those operations need
    to understand how we're linking Clients with Persons, which is
    largely what the write ops are all about.

  - UI for managing Clients

  - Bypass uPortal session wiggler for OAuth calls

  - Make sure sessions aren't being created for each OAuth call

  - Check for session timeout regressions in the UI

  - Check that 1st time logins still work when rendering the portlet

  - Namespace OAuth2 beans and URLs so we can more easily support Oauth1
    (for URLs, though, I could not even get a custom /ssp/api/1/oauth/**
    namespace to work)

  - Database-backed Token management - hopefully just use JdbcTokenStore and
    JdbcClientTokenServices

  - Can we support refresh Tokens?

  - Update docs, especially around Person management

  - How far away are we from an authorization dance?
NOJIRA Whitespace cleanup
NOJIRA Database-persistent Oauth2 Clients