spring-projects/spring-security-oauth — pull request #307 by Javaman44 (2014-11-09 14:39:58+00:00)
Title: Error on json callback and ResourceServerConfiguration in sparklr2 #304

(It's my fisrt pull request, i think this the right place/branch)

Hello,

I found some little errors on Saprklr2 sample application. I compiled on netbean 8 with jdk 1.7 without problem but when you login with marissa account there is an error (js) in browser console.
In fact you can't see the photo of marissa throught sparklr2 webapp: she doesn't have right access.

You need to give also access to the ROLE_USER to ressource "photo"

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

/* ... some code .... */

@Override
public void configure(HttpSecurity http) throws Exception {
// @formatter:off
http
.requestMatchers().antMatchers("/photos/**", "/oauth/users/**", "/oauth/clients/**","/me")
.and()
/* ... some code .... */
.antMatchers("/photos").access("#oauth2.hasScope('read') or hasRole('ROLE_USER')")
/* ... some code .... */
.antMatchers("/photos/**").access("#oauth2.hasScope('read') or hasRole('ROLE_USER')")
/* ... some code .... */

The purpose of the sample application is to get ressource from sparklr2 via tonr2 so this issue is not very important.
I have also noticied a js error on chrome related to MIME type. To correct this i changed mime type in PhotoController:

@RequestMapping(value = "/photos", params = "format=json")
public ResponseEntity getJsonPhotos(@RequestParam(value = "callback", required = false) String callback, Principal principal) {

/* ... some code .... */

HttpHeaders headers = new HttpHeaders();
//headers.set("Content-Type", "application/json");
headers.set("Content-Type", "application/javascript");

/* ... some code .... */

In fact it's not really "application/json" because it's JSONP which is javascript.

Regards