Spring OAuth2 redirect when Token expired
<p>I am struggling to do this simple thing in Spring: <strong>Redirecting to the Login page when the access token expires.</strong></p>

<p>I have:</p>

<ul>
<li>a Edge Server (Zuul) for routing.</li>
<li>a OAuth2 authorization / authentication server.</li>
<li>a Resource Server that serves static files.</li>
</ul>

<p>For specific security reasons I do not want any refresh token, when my TOKEN expires I want the user to login again.</p>

<p>In my understanding the Resource Server should be the one handling this mechanism (correct me if I am wrong).</p>

<p>I have been trying different unsuccessful approaches:</p>

<ul>
<li>Adding a filter After OAuth2AuthenticationProcessingFilter and check for Token validity and sendRedirect </li>
<li>Adding a custom OAuth2AuthenticationEntryPoint to my application (extending ResourceServerConfigurerAdapter)</li>
<li>Adding .exceptionHandling() with a custom handler / entry point.</li>
</ul>

<p>Below my security configurations.</p>

<h2>Auth Server Security Config:</h2>

<pre><code>@Configuration
@EnableAuthorizationServer
public class AuthorizationServerOAuthConfig extends AuthorizationServerConfigurerAdapter {
    ....

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
                .authenticationManager(this.authenticationManager)
                .accessTokenConverter(accessTokenConverter())
                .approvalStore(approvalStore())
                .authorizationCodeServices(authorizationCodeServices())
                .tokenStore(tokenStore());
    }

    /**
      * Configure the /check_token endpoint.
      * This end point will be accessible for the resource servers to verify the token validity
      * @param securityConfigurer
      * @throws Exception
      */
    @Override
    public void configure(AuthorizationServerSecurityConfigurer securityConfigurer) throws Exception {
        securityConfigurer
            .tokenKeyAccess("permitAll()")
            .checkTokenAccess("hasAuthority('ROLE_TRUSTED_CLIENT')");
    }
}

@Configuration
@Order(-20)
public class AuthorizationServerSecurityConfig extends WebSecurityConfigurerAdapter {

    private static final Logger log = LoggerFactory.getLogger(AuthorizationServerSecurityConfig.class);

    @Autowired
    private DataSource oauthDataSource;

    @Autowired
    private AuthenticationFailureHandler eventAuthenticationFailureHandler;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    public void globalUserDetails(AuthenticationManagerBuilder auth) throws UserDetailsException {
        try {
            log.debug("Updating AuthenticationManagerBuilder to use userDetailService with a BCryptPasswordEncoder");
            auth.userDetailsService(userDetailsService()).passwordEncoder(new BCryptPasswordEncoder());
        } catch (Exception e) {
            throw new UserDetailsException(e);
        }
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    public UserDetailsService userDetailsService() {
        return this.userDetailsService;
    }

    @Override
    protected void configure(final HttpSecurity http) throws Exception {
        log.debug("Updating HttpSecurity configuration");

        // @formatter:off
        http
            .requestMatchers()
                .antMatchers("/login*", "/login?error=true", "/oauth/authorize", "/oauth/confirm_access")
                .and()
            .authorizeRequests()
                .antMatchers("/login*", "/oauth/authorize", "/oauth/confirm_access").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .failureUrl("/login?error=true")
                .failureHandler(eventAuthenticationFailureHandler);
        // @formatter:on
    }
</code></pre>

<p>Its application.yml</p>

<pre><code>server:
    port: 9999
    contextPath: /uaa

eureka:
    client:
        serviceUrl:
            defaultZone: http://localhost:8761/eureka/

security:
    user:
        password: password

spring:
    datasource_oauth:
        driverClassName: com.mysql.jdbc.Driver
        url: jdbc:mysql://localhost:3306/oauth2_server
        username: abc
        password: 123
    jpa:
        ddl-create: true
    timeleaf:
        cache: false
        prefix: classpath:/templates

logging:
    level:
        org.springframework.security: DEBUG

authentication:
    attempts:
        maximum: 3
</code></pre>

<h2>Resource Server Security Config - UPDATED:</h2>

<pre><code>@EnableResourceServer
@EnableEurekaClient
@SpringBootApplication
public class Application extends ResourceServerConfigurerAdapter {

    private CustomAuthenticator customFilter = new CustomAuthenticator();

    /**
     * Launching Spring Boot
     * @param args
     */
    public static void main(String[] args) {
        SpringApplication.run(Application.class, args); //NOSONAR
    }

    /**
     * Configuring Token converter
     * @return
     */
    @Bean
    public AccessTokenConverter accessTokenConverter() {
        return new DefaultAccessTokenConverter();
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.authenticationManager(customFilter);
    }

    /**
     * Configuring HTTP Security
     * @param http
     * @throws Exception
     */
    @Override
    public void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http
            .authorizeRequests().antMatchers("/**").authenticated()
            .and()
                .csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            .and()
                .addFilterBefore(customFilter, AbstractPreAuthenticatedProcessingFilter.class);

        // @formatter:on
    }

    protected static class CustomAuthenticator extends OAuth2AuthenticationManager implements Filter {

        private static Logger logger = LoggerFactory.getLogger(CustomAuthenticator.class);
        private TokenExtractor tokenExtractor = new BearerTokenExtractor();
        private AuthenticationManager authenticationManager;
        private AuthenticationDetailsSource&lt;HttpServletRequest, ?&gt; authenticationDetailsSource = new OAuth2AuthenticationDetailsSource();
        private boolean inError = false;

        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            try {
                return super.authenticate(authentication);
            }
            catch (Exception e) {
                inError = true;
                return new CustomAuthentication(authentication.getPrincipal(), authentication.getCredentials());
            }
        }

        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
                throws ServletException, IOException {

            logger.debug("Token Error redirecting to Login page");

            if(this.inError) {
                logger.debug("In error");

                RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

                final HttpServletRequest req = (HttpServletRequest) request;
                final HttpServletResponse res = (HttpServletResponse) response;

                redirectStrategy.sendRedirect(req, res, "http://localhost:8765/login");

                this.inError = false;
                return;
            } else {
                filterChain.doFilter(request, response);
            }
        }

        @Override
        public void destroy() {
        }

        @Override
        public void init(FilterConfig arg0) throws ServletException {
        }

        @SuppressWarnings("serial")
        protected static class CustomAuthentication extends PreAuthenticatedAuthenticationToken {

            public CustomAuthentication(Object principal, Object credentials) {
                super(principal, credentials);
            }

        }

    }
}
</code></pre>

<p>Its application.yml:</p>

<pre><code>server:
    port: 0

eureka:
    client:
        serviceUrl:
            defaultZone: http://localhost:8761/eureka/

security:
    oauth2:
        resource:
            userInfoUri: http://localhost:9999/uaa/user

logging:
    level:
        org.springframework.security: DEBUG
</code></pre>

<h2>Edge Server Configuration:</h2>

<pre><code>@SpringBootApplication
@EnableEurekaClient
@EnableZuulProxy
@EnableOAuth2Sso
public class EdgeServerApplication extends WebSecurityConfigurerAdapter {

    /**
     * Configuring Spring security
     * @return
     */
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http.logout()
            .and()
                .authorizeRequests().antMatchers("/**").authenticated()
            .and()
                .csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
        // @formatter:on
    }

    /**
     * Launching Spring Boot
     * @param args
     */
    public static void main(String[] args) {
        SpringApplication.run(EdgeServerApplication.class, args); //NOSONAR
    }
}
</code></pre>

<p>Its application.yml config:</p>

<pre><code>server:
    port: 8765

eureka:
    client:
        serviceUrl:
            defaultZone: http://localhost:8761/eureka/

security:
    user:
        password: none
    oauth2:
        client:
            accessTokenUri: http://localhost:9999/uaa/oauth/token
            userAuthorizationUri: http://localhost:9999/uaa/oauth/authorize
            clientId: spa
            clientSecret: spasecret
        resource:
            userInfoUri: http://localhost:9999/uaa/user

zuul:
    debug:
        request: true
    routes:
        authorization-server:
            path: /uaa/**
            stripPrefix: false
        fast-funds-service:
            path: /**

logging:
    level:
        org.springframework.security: DEBUG
</code></pre>

<p>Thanks for the help</p>