Ensure Spring Security OAuth works well with Sagan

[rwinch]

Summary

We should provide a pull request to Sagan to update to use the new Spring Security OAuth support. Along the way we should find any areas for improvements in Spring Security OAuth support and make them.

[jgrandja]

@rwinch As mentioned, @bclozel is currently in the process of upgrading Sagan to Spring Boot 2. As soon as that is complete, I'll upgrade it to use the new OAuth client support.

[jgrandja]

@bclozel I'm circling back to this issue and wondering if you have already updated Sagan to use Spring Security's OAuth client support?

[bclozel]

Hey @jgrandja thanks for reaching out!

We're now using the Spring Security OAuth client support, see the security config class and the github client registration.

As far as I understand the only missing piece in our security arrangement would be to use Bearer tokens as an authentication mechanism for the API (see spring-attic/sagan#1025).

[jgrandja]

Thanks for the update @bclozel !

Bearer token authentication could be configured by adding a BearerTokenAuthenticationFilter as @rwinch mentioned. Let me know if you need any help with this.

[jgrandja]

Resolved as per comment.