Application.kt

@SpringBootApplication
class Application {


    @Bean
    fun provideTokenStore() : TokenStore {
        return InMemoryTokenStore()
    }

    @Bean
    fun providePasswordEncoder() : BCryptPasswordEncoder {
        return BCryptPasswordEncoder()
    }


    companion object {
        @JvmStatic
        fun main(args: Array<String>) {
            SpringApplication.run(Application::class.java, *args)
        }
    }

}

AuthorizationServerConfiguration.kt

package com.levinzonr.ezpad.security.auth

import com.levinzonr.ezpad.security.resource.ResourceServerSettings
import com.levinzonr.ezpad.services.EzpadUserDetailService
import org.springframework.beans.factory.annotation.Autowired
import org.springframework.context.annotation.Configuration
import org.springframework.security.authentication.AuthenticationManager
import org.springframework.security.crypto.password.PasswordEncoder
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer
import org.springframework.security.oauth2.provider.token.TokenStore


@Configuration
@EnableAuthorizationServer
class AuthorizationServerConfiguration : AuthorizationServerConfigurerAdapter() {


    @Autowired
    private lateinit var userDetailsService: UserDetailsService

    @Autowired
    private lateinit var passwordEncoder: PasswordEncoder

    @Autowired
    private lateinit var tokenStore: TokenStore

    @Autowired
    private lateinit var authenticationManager: AuthenticationManager


    override fun configure(endpoints: AuthorizationServerEndpointsConfigurer?) {
        endpoints?.tokenStore(tokenStore)
                ?.authenticationManager(authenticationManager)
                ?.userDetailsService(userDetailsService)
    }

    override fun configure(clients: ClientDetailsServiceConfigurer?) {
        clients?.inMemory()
                ?.withClient(AuthorizationSettings.AUTH_CLIENT_NAME)
                ?.authorizedGrantTypes("password", "refresh_token")
                ?.resourceIds(ResourceServerSettings.RESOURCE_ID)
                ?.secret(passwordEncoder.encode(AuthorizationSettings.AUTH_CLIENT_SECRET))

                ?.scopes("mobile_app")
    }

    override fun configure(security: AuthorizationServerSecurityConfigurer?) {
        security?.passwordEncoder(passwordEncoder)
    }



}

ResourceServerConfiguration.kt

package com.levinzonr.ezpad.security.resource

import org.springframework.context.annotation.Configuration
import org.springframework.http.HttpMethod
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity
import org.springframework.security.config.annotation.web.builders.HttpSecurity

import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer

@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
class ResourceServerConfiguration : ResourceServerConfigurerAdapter() {

    override fun configure(resources: ResourceServerSecurityConfigurer?) {
        resources?.resourceId(ResourceServerSettings.RESOURCE_ID)
    }

    override fun configure(http: HttpSecurity?) {
        http?.authorizeRequests()
                ?.antMatchers(HttpMethod.POST, "/oauth/**")?.permitAll()
                ?.antMatchers("/auth/**")?.permitAll()
                ?.antMatchers(HttpMethod.OPTIONS, "/api/**")?.permitAll()
                ?.and()
                ?.antMatcher("/api/**")?.authorizeRequests()
                ?.antMatchers(HttpMethod.POST, "/api/users")?.permitAll()
                ?.anyRequest()?.authenticated()
    }

}