Migrate Spring Security OAuth to Spring Authorization Server and recreate token store

We are using Spring Security OAuth, a third-party library developed by VMware, Inc., which is no longer actively maintained. The repository is still available but has been archived.

Spring has introduced support for OAuth 2.0 in Spring Security, but they have noticeably changed the overall approach.

A migration guide from the Spring team is available OAuth 2.0 Migration Guide

We will need to redefine all the services and classes that use org.springframework.security.oauth2.provider.* packages (maybe something else).

Some classes have direct replacements in the new Spring OAuth library. For example:

org.springframework.security.oauth2.common.OAuth2AccessToken → org.springframework.security.oauth2.core.OAuth2AccessToken

org.springframework.security.oauth2.common.OAuth2RefreshToken → org.springframework.security.oauth2.core.OAuth2RefreshToken

To-Do details

Re-Create TokenStore

org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore doesn’t exist anymore. Bean defined in:

webapp/WEB-INF/spring/oauth/token-store.xml

webapp/WEB-INF/spring/oauth/token-store.xml

webapp/WEB-INF/spring/oauth/token-store.xml

Since TokenStore doesn’t exist anymore we need to re-write com.kontrolscan.dao.OAuth2RepositoryTokenStore.

Other unavailable classes:

org.springframework.security.oauth2.provider.OAuth2Authentication

org.springframework.security.oauth2.provider.token.AuthenticationKeyGenerator

org.springframework.security.oauth2.provider.token.DefaultAuthenticationKeyGenerator

org.springframework.security.oauth2.provider.token.TokenStore

Move to Java configurations