Auto-configure Spring Security OAuth2 when detected on the classpath

* Automatically spin up Authorization Server and Resource Server
* Automatically configures method level security included OAuth2Expression handler
* Wrote extensive unit tests verifying default behavior as well as the auto-configuration backing off when custom Authorization/Resource servers are included
* Created org.springframework.boot.security.oauth2 subpackage to contain it
* Can also disable either resource of authorization server completely with a single property for each
* Print out the auto-generated secrets and other settings
* Added spring-boot-sample-secure-oauth2 to provide a sample that can be run and poked with curl as well as some automated tests.
* Make users ask for which servers to install by adding @Enable*
* User has to @EnableGlobalMethodSecurity instead of using properties files

Add Spring Security OAuth2 support to Spring Boot CLI

* Triggered from either @EnableAuthorizationServer or @EnableResourceServer
* Needs to have @EnableGlobalMethodSecurity to allow picking the annotation model.
* By default, comes with import support for @PreAuthorize, @PreFilter, @PostAuthorize, and @PostFilter via a single start import
* Also need import support for the enable annotations mentioned above.
* Added extra test case and sample (oauth2.groovy)

spring-boot-samples/spring-boot-sample-secure-oauth2/src/main/java/sample/Application.java

@@ -0,0 +1,110 @@
+/*
+ * Copyright 2012-2014 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
+import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
+
+// @formatter:off
+/**
+ * After you launch the app, you can seek a bearer token like this:
+ *
+ * <pre>
+ *
+ * curl localhost:8080/oauth/token -d "grant_type=password&scope=read&username=greg&password=turnquist" -u foo:bar
+ *
+ * </pre>
+ *
+ * <ul>
+ * <li>grant_type=password (user credentials will be supplied)</li>
+ * <li>scope=read (read only scope)</li>
+ * <li>username=greg (username checked against user details service)</li>
+ * <li>password=turnquist (password checked against user details service)</li>
+ * <li>-u foo:bar (clientid:secret)</li>
+ * </ul>
+ *
+ * Response should be similar to this:
+ * <code>{"access_token":"533de99b-5a0f-4175-8afd-1a64feb952d5","token_type":"bearer","expires_in":43199,"scope":"read"}</code>
+ *
+ * With the token value, you can now interrogate the RESTful interface like this:
+ *
+ * <pre>
+ * curl -H "Authorization: bearer [access_token]" localhost:8080/flights/1
+ * </pre>
+ *
+ * You should then see the pre-loaded data like this:
+ *
+ * <pre>
+ * {
+ *      "origin" : "Nashville",
+ *      "destination" : "Dallas",
+ *      "airline" : "Spring Ways",
+ *      "flightNumber" : "OAUTH2",
+ *      "date" : null,
+ *      "traveler" : "Greg Turnquist",
+ *      "_links" : {
+ *          "self" : {
+ *              "href" : "http://localhost:8080/flights/1"
+ *          }
+ *      }
+ * }
+ * </pre>
+ *
+ * Test creating a new entry:
+ *
+ * <pre>
+ * curl -i -H "Authorization: bearer [access token]" -H "Content-Type:application/json" localhost:8080/flights -X POST -d @flight.json
+ * </pre>
+ *
+ * Insufficient scope? (read not write) Ask for a new token!
+ *
+ * <pre>
+ * curl localhost:8080/oauth/token -d "grant_type=password&scope=write&username=greg&password=turnquist" -u foo:bar
+ *
+ * {"access_token":"cfa69736-e2aa-4ae7-abbb-3085acda560e","token_type":"bearer","expires_in":43200,"scope":"write"}
+ * </pre>
+ *
+ * Retry with the new token. There should be a Location header.
+ *
+ * <pre>
+ * Location: http://localhost:8080/flights/2
+ *
+ * curl -H "Authorization: bearer [access token]" localhost:8080/flights/2
+ * </pre>
+ *
+ * @author Craig Walls
+ * @author Greg Turnquist
+ */
+// @formatter:on
+
+@Configuration
+@ComponentScan
+@EnableAutoConfiguration
+@EnableAuthorizationServer
+@EnableResourceServer
+@EnableGlobalMethodSecurity(prePostEnabled = true)
+public class Application {
+
+	public static void main(String[] args) {
+		SpringApplication.run(Application.class, args);
+	}
+
+}

spring-boot-samples/spring-boot-sample-secure-oauth2/src/main/java/sample/Flight.java

@@ -0,0 +1,101 @@
+/*
+ * Copyright 2012-2014 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample;
+
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import java.util.Date;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+/**
+ * Domain object for tracking flights
+ *
+ * @author Craig Walls
+ * @author Greg Turnquist
+ */
+@Entity
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class Flight {
+
+	@Id @GeneratedValue(strategy = GenerationType.AUTO)
+	private Long id;
+
+	private String origin;
+	private String destination;
+	private String airline;
+	private String flightNumber;
+	private Date date;
+	private String traveler;
+
+	public Long getId() {
+		return id;
+	}
+
+	public void setId(Long id) {
+		this.id = id;
+	}
+
+	public String getOrigin() {
+		return origin;
+	}
+
+	public void setOrigin(String origin) {
+		this.origin = origin;
+	}
+
+	public String getDestination() {
+		return destination;
+	}
+
+	public void setDestination(String destination) {
+		this.destination = destination;
+	}
+
+	public String getAirline() {
+		return airline;
+	}
+
+	public void setAirline(String airline) {
+		this.airline = airline;
+	}
+
+	public String getFlightNumber() {
+		return flightNumber;
+	}
+
+	public void setFlightNumber(String flightNumber) {
+		this.flightNumber = flightNumber;
+	}
+
+	public Date getDate() {
+		return date;
+	}
+
+	public void setDate(Date date) {
+		this.date = date;
+	}
+
+	public String getTraveler() {
+		return traveler;
+	}
+
+	public void setTraveler(String traveler) {
+		this.traveler = traveler;
+	}
+}

spring-boot-samples/spring-boot-sample-secure-oauth2/src/main/java/sample/FlightRepository.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2012-2014 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package sample;
+
+import org.springframework.data.repository.CrudRepository;
+import org.springframework.security.access.prepost.PreAuthorize;
+
+/**
+ * Spring Data interface with secured methods
+ *
+ * @author Craig Walls
+ * @author Greg Turnquist
+ */
+public interface FlightRepository extends CrudRepository<Flight, Long> {
+
+	@PreAuthorize("#oauth2.hasScope('read')")
+	@Override
+	Iterable<Flight> findAll();
+
+	@PreAuthorize("#oauth2.hasScope('read')")
+	@Override
+	Flight findOne(Long aLong);
+
+	@PreAuthorize("#oauth2.hasScope('write')")
+	@Override
+	<S extends Flight> S save(S entity);
+}