java - Flaw in Spring security OAuth2 samples: same OAuth2ClientContext used for several providers -

i try implement oauth2 spring security , have studied samples provided spring in following github: https://github.com/spring-projects/spring-security-oauth/blob/master/samples/oauth2/tonr/src/main/java/org/springframework/security/oauth/examples/config/webmvcconfig.java

this oauth2 sample divided in 2 projects :

• tonr: oauth2 client (oauth2client) ,
• sparklr: oauth2 provider (resourceserver & authorizationserver)

tonr allows show photos sparklr , includes facebook api client list friends of account. seems once got 1 provider, the same token sent oauth2 providers, if token doesn't come called provider.

steps:

• i log in tonr2 (localhost:8080/tonr2/login.jsp)
• i go sparklr photos , log in sparklr2 (localhost:8080/tonr2/sparklr/photos & localhost:8080/sparklr2/login.jsp)
• i approve scope read , see photos: ok
• then go facebook friends page : localhost:8080/tonr2/facebook/info

the sparklr token sent facebook (visible in debug logs), , facebook returns 400 bad request error.

if now, log out tonr, click directly facebook friends page , log in tonr again, working; token asked facebook , access granted. same oauth2clientcontext , same token kept sparklr facebook.

question: how separate oauth2clientcontext keep token respective resource server?

i tried instanciate different oauth2clientcontext bean facebookresttemplate, oauth2 flow broken with:

@bean(name = "facebookclientcontext") public oauth2clientcontext facebookclientcontext() {     return new defaultoauth2clientcontext(); }  @bean public oauth2resttemplate facebookresttemplate(@qualifier("facebookclientcontext") oauth2clientcontext clientcontext) {     ... 

i had same problem. solved same did except should:

1. inject accesstokenrequest (request-scoped) in constructor of defaultoauth2clientcontext. (@resource injection necessary in verion of spring because accesstokenrequest map).
2. session-scope facebookclientcontext not share tokens among differents users.

see oauth2clientconfiguration guideline.

modify webmvcconfig$resourceconfiguration:

    @resource(name = "accesstokenrequest")     private accesstokenrequest accesstokenrequest;      @bean     @qualifier("facebookclientcontext")     @scope(value = "session", proxymode = scopedproxymode.interfaces)     public defaultoauth2clientcontext facebookclientcontext() {         return new defaultoauth2clientcontext(accesstokenrequest);     }      @bean     public oauth2resttemplate facebookresttemplate(             @qualifier("facebookclientcontext") oauth2clientcontext clientcontext) {         oauth2resttemplate template = new oauth2resttemplate(facebook(), clientcontext);         mappingjackson2httpmessageconverter converter = new mappingjackson2httpmessageconverter();         converter.setsupportedmediatypes(                 arrays.aslist(mediatype.application_json, mediatype.valueof("text/javascript")));         template.setmessageconverters(arrays.<httpmessageconverter<?>>aslist(converter));         return template;     }      @bean     public oauth2resttemplate sparklrresttemplate(             @qualifier("oauth2clientcontext") oauth2clientcontext clientcontext) {         return new oauth2resttemplate(sparklr(), clientcontext);     }      @bean     public oauth2resttemplate sparklrredirectresttemplate(             @qualifier("oauth2clientcontext") oauth2clientcontext clientcontext) {         return new oauth2resttemplate(sparklrredirect(), clientcontext);     }