What's the simplest way to do the following in an AngularJS with spring-boot backend application:
Allow end-users to authenticate using a social SSO such as Twitter, and once authenticated use their authentication token to authenticate to my own SPA's backend endpoint so that when they call my secured APIs I can:
- protect my API with a per-user authentication vs. one shared secret for all SPA instances
- Be able to perform social API calls on behalf of the user that called the API knowing that they are currently authenticated and linked my app to that social site?
I spent many hours reading this collection of articles Spring Security and Angular JS by Dave Syer from the Spring OAuth project, (Great read!) but I still didn't find a good example on how to do this simple authentication delegation of the current authenticated user to the server API calls easily.
What I expected is that would be able to:
- Authenticate the SPA user using the spring-social integration
- Add an inteceptor through the $httpProvider to $http calls to inject the needed bearer headers to delegate the logged-in user to my backend server so that all API calls will be trusted to be done by that logged in user, and - be able to perform API calls to the social network on their behalf based on that bearer token in each API call
Btw, I'm looking for real working examples, not theoretical pseudo-code since the theory is quite understood by now, but a proper implementation is hard to find and that part of the Spring libraries is not well documented... (feels like there should be a spring-boot-starter or spring-cloud-starter package for this... hint, hint... :-) )