Converting security exceptions to API responses

[jas]

I can see that simply adding those additional classes is not sufficient. I plumbed together some things and submitted a request with a long ago expired access token and got:

2012-03-20 15:50:12 DEBUG filter.OAuth2ProtectedResourceFilter - Token not found in headers. Trying request parameters.
2012-03-20 15:50:12 DEBUG cassandra.CassandraTokenStore - readAccessToken - For tokenValue: ad41945d-9bfa-4ee8-a564-d28ee468e1e9, returning token: null
2012-03-20 15:50:12 DEBUG error.DefaultProviderExceptionHandler - OAuth error.
error="invalid_token", error_description="Invalid access token: ad41945d-9bfa-4ee8-a564-d28ee468e1e9"
	at org.springframework.security.oauth2.provider.token.RandomValueTokenServices.loadAuthentication(RandomValueTokenServices.java:158)
	at org.springframework.security.oauth2.provider.filter.OAuth2ProtectedResourceFilter.doFilter(OAuth2ProtectedResourceFilter.java:47)
	at org.springframework.security.oauth2.provider.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:79)
	at org.springframework.security.oauth2.provider.filter.OAuth2ExceptionHandlerFilter.doFilter(OAuth2ExceptionHandlerFilter.java:57)
	at org.springframework.security.oauth2.provider.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:79)
	at org.springframework.security.oauth2.provider.filter.CompositeFilter.doFilter(CompositeFilter.java:59)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1322)
        ...

The class DefaultProviderExceptionHandler exists in the jar from Maven, but not in the M6-ish source I have. So, there must be some deletions and other things done post M6 that I need to incorporate.

An M7, RC1 or whatever would be helpful.

Cheers,

Jeff

[Dave Syer]

The log extract looks clean. What's the problem, exactly? You didn't get a JSON response?

[jas]

I got a JSON response, but my code based on OAuth2AccessDeniedHandler for serializing the response did not get invoked. I'm wondering if my kludged implementation has all of its wires connected.

Jeff

[Dave Syer]

AccessDeiniedHandler is called by the ExceptionTranslationFilter if it catches an AccessDeniedException. Your exception looks like an OAuth2Exception, which is not an AccessDeniedException, but is an AuthenticationException. Where it is handled depends on where it is thrown, but I would expect it would be picked up by an AuthenticationEntryPoint. Does that make sense?

[jas]

Hi Dave:

That does make sense. Back to the code. Thanks for the pointer!

Jeff