Authentication provider errors after upgrading to SCDF 2.10.0

[DanFrei]

Description:
After upgrading from SCDF server 2.9.4 to 2.9.10, any attempt to access the SCDF was no longer possible as any sent requests are being denied with error 401.
When checking the logs, the following error message is shown:
org.springframework.security.authentication.ProviderNotFoundException: No AuthenticationProvider found for org.springframework.security.oauth2.client.authentication.OAuth2LoginAuthenticationToken

After downgrading backwards to the previous version, everything was ok.
Besides upgrading SCDF's version nothing was changed and the configuration remained the same.
We configure the Authentication Provider and all the relevant creds and properties as it should be done the - "spring-security way" per the guidelines in the documentation (and as stated previously, the configuration was not changed and after downgrading back the version, it returned working again).
We pass all the aforementioned properties via SCDF'S manifest.yml as follows (bellow please see a screenshot of the relevant section in the manifest.yml. Also, see manifest.yml attached):

uas-dataflow-server-manifest-template.txt

I currently can't tell if it's a bug or rather something has been changed in the way oAuth providers should be configured (at least in the documentation I haven't noticed any news) .
** I did notice that in V2.10.0 the dependency of the deprecated spring-security-oauth2 has been removed but I don't know for certain if this change had anything to do with the problem we're facing.
Your kind assistance is highly appreciated!

Release versions:
2.10.0

https://github.com/spring-cloud/spring-cloud-dataflow/releases/tag/v2.10.0

Steps to reproduce:

1. upgrade to SCDF 2.10.0
2. configure the authentication properties per the description above (kindly use similar oauth configuration with (see 'env' section in the yml)

Error & Stacktrace
o.s.c.c.s.OAuthSecurityConfiguration : An authentication failure event occurred while accessing a REST resource that requires authentication. 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT org.springframework.security.authentication.ProviderNotFoundException: No AuthenticationProvider found for org.springframework.security.oauth2.client.authentication.OAuth2LoginAuthenticationToken 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:234) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:201) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter.attemptAuthentication(OAuth2LoginAuthenticationFilter.java:195) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:227) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:217) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter.doFilterInternal(OAuth2AuthorizationRequestRedirectFilter.java:178) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:112) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:82) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.session.DisableEncodeUrlFilter.doFilterInternal(DisableEncodeUrlFilter.java:42) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:221) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:186) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:96) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.cloudfoundry.router.ClientCertificateMapper.doFilter(ClientCertificateMapper.java:79) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:177) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:769) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:891) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1784) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 2022-12-20T05:57:53.31+0000 [APP/PROC/WEB/0] OUT at java.lang.Thread.run(Thread.java:750)

Screenshots:

[DanFrei]

Attached maifest.yml template (in order to upload it, I attched it as txt rather than yml:
uas-dataflow-server-manifest-template.txt

[onobc]

Thanks for the report @DanFrei

We will take a look as soon as possible. Most of us are on PTO until beginning of the year so not sure if we will look before then. I just wanted to let you know we see the report and will get to it asap.

[corneil]

@DanFrei The "documentation" you linked to is for an older version of SCDF, namely 2.3.
Here is a typical set of properties when using UAA:

      - spring.cloud.dataflow.security.authorization.provider-role-mappings.uaa.map-oauth-scopes=true
      - spring.cloud.dataflow.security.authorization.provider-role-mappings.uaa.role-mappings.ROLE_CREATE=dataflow.create
      - spring.cloud.dataflow.security.authorization.provider-role-mappings.uaa.role-mappings.ROLE_DEPLOY=dataflow.deploy
      - spring.cloud.dataflow.security.authorization.provider-role-mappings.uaa.role-mappings.ROLE_DESTROY=dataflow.destroy
      - spring.cloud.dataflow.security.authorization.provider-role-mappings.uaa.role-mappings.ROLE_MANAGE=dataflow.manage
      - spring.cloud.dataflow.security.authorization.provider-role-mappings.uaa.role-mappings.ROLE_MODIFY=dataflow.modify
      - spring.cloud.dataflow.security.authorization.provider-role-mappings.uaa.role-mappings.ROLE_SCHEDULE=dataflow.schedule
      - spring.cloud.dataflow.security.authorization.provider-role-mappings.uaa.role-mappings.ROLE_VIEW=dataflow.view
      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_REDIRECT_URI={baseUrl}/login/oauth2/code/{registrationId}
      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_AUTHORIZATION_GRANT_TYPE=authorization_code
      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_CLIENT_ID=dataflow
      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_CLIENT_SECRET=secret
      - SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_SCOPE=openid,dataflow.create,dataflow.deploy,dataflow.destroy,dataflow.manage,dataflow.modify,dataflow.schedule,dataflow.view
      - SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_JWK_SET_URI=http://localhost:8080/uaa/token_keys
      - SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_TOKEN_URI=http://localhost:8080/uaa/oauth/token
      - SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_USER_INFO_URI=http://localhost:8080/uaa/userinfo
      - SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_USER_NAME_ATTRIBUTE=user_name
      - SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_AUTHORIZATION_URI=http://localhost:8080/uaa/oauth/authorize
      - SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_INTROSPECTION_URI=http://localhost:8080/uaa/introspect
      - SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT_ID=dataflow
      - SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT_SECRET=secret
      - SPRING_SECURITY_OAUTH2_AUTHORIZATION_CHECK_TOKEN_ACCESS=isAuthenticated()

[markpollack]

issue for docs to improve created here - spring-io/dataflow.spring.io#478

[DanFrei]

Hello @corneil ,

Thanks you so much for the assistance!
I've tried adjusting the UAA configuration properties per your suggestion and yet the same problem remains.

UAA properties after ajustment:

SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_INTROSPECTION_URI: "${vcap.services.uas-xsuaa.credentials.url}/introspect"
      SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT_ID: "${vcap.services.uas-xsuaa.credentials.clientid}"
      SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT_SECRET: "${vcap.services.uas-xsuaa.credentials.clientsecret}"

      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_USER_NAME_ATTRIBUTE: user_name
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_USER_INFO_URI: "${vcap.services.uas-xsuaa.credentials.url}/userinfo"
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_AUTHORIZATION_URI: "${vcap.services.uas-xsuaa.credentials.url}/oauth/authorize"
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_TOKEN_URI: "${vcap.services.uas-xsuaa.credentials.url}/oauth/token"

      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_CLIENT_ID: "${vcap.services.uas-xsuaa.credentials.clientid}"
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_CLIENT_SECRET: "${vcap.services.uas-xsuaa.credentials.clientsecret}"
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_REDIRECT_URI: "{baseUrl}/login/oauth2/code/{registrationId}"

When reverting back to SCDF 2.9.6 everything works properly.
Any ideas?


Kind Regards,
Daniel.

      
 

[corneil]

Which version of UAA did you use?
Which version of TAS?

[corneil]

This setting was missing in your 2nd set:

SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_AUTHORIZATION_GRANT_TYPE=authorization_code

And the following settings are not in your 1st set:

SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_SCOPE=openid,dataflow.create,dataflow.deploy,dataflow.destroy,dataflow.manage,dataflow.modify,dataflow.schedule,dataflow.view
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_JWK_SET_URI=http://localhost:8080/uaa/token_keys
SPRING_SECURITY_OAUTH2_AUTHORIZATION_CHECK_TOKEN_ACCESS=isAuthenticated()

Your original environmental variables had - (dash) in the names where it should be _(underscore), e.g. CLIENT-ID instead of CLIENT_ID

[corneil]

Your YAML updated:

---
context: (( &temporary ( merge ) ))

spring-application-yaml:
  <<<: (( &temporary ))
  spring.cloud.dataflow:
    task.platform.cloudfoundry.accounts:
      default:
        connection:
          url: (( .context.imports.cf.cc.srv_api_uri ))
          org: (( .context.product_config.uas_org "%UAS_DEV_SUFFIX%" ))
          space: (( .context.product_config.uas_space "%UAS_DEV_SUFFIX%" ))
          domain: (( .context.imports.cf.deprecated.app_domain ))
          username: CF_DATA_FLOW_USER
          password: ((!uas_dataflow_password))
          loginHint: (( .context.config.scdf_login_hint || "%7B%22origin%22%3A%22uaa%22%7D" ))
          skipSsValidation: false
        deployment:
          services: uas_credentials, uas-data-flow-server, uas-dataflow-postgres %OPTIONAL_BOUND_SERVICES%
          apiTimeout: 1200
    security.authorization.provider-role-mappings.uaa:
      map-oauth-scopes: true
      role-mappings:
        ROLE_CREATE: "%XSAPPNAME%.UAS.operations.read"
        ROLE_DEPLOY: "%XSAPPNAME%.UAS.operations.read"
        ROLE_DESTROY: "%XSAPPNAME%.UAS.operations.read"
        ROLE_MANAGE: "%XSAPPNAME%.UAS.operations.read"
        ROLE_MODIFY: "%XSAPPNAME%.UAS.operations.read"
        ROLE_SCHEDULE: "%XSAPPNAME%.UAS.operations.read"
        ROLE_VIEW: "%XSAPPNAME%.UAS.operations.read"

applications:
  - name: uas-dataflow-server%UAS_DEV_SUFFIX%
    memory: (( .context.product_config.deployment.level_3.uas_micro_services.uas_dataflow.memory ))
    instances: (( .context.product_config.deployment.level_3.uas_micro_services.uas_dataflow.instances ))
    timeout: 180
    path: uas-dataflow-server.jar
    services:
      (( .context.product_config.deployment.level_3.uas_micro_services.uas_dataflow.bindings ))
    routes:
      - route: (( "uas-dataflow-server%UAS_DEV_SUFFIX%." .context.imports.cf.deprecated.app_domain ))
    buildpacks:
      - uas_dataflow_server_buildpack%UAS_DEV_SUFFIX%
      - java_buildpack
    env:
      JAVA_OPTS: '-XX:MaxDirectMemorySize=1500M'
      SPRING_CLOUD_DATAFLOW_FEATURES_SCHEDULES_ENABLED: false
      SPRING_CLOUD_DATAFLOW_FEATURES_STREAMS_ENABLED: false
      SPRING_PROFILES_DEFAULT: cloud
      JBP_CONFIG_SPRING_AUTO_RECONFIGURATION: '{enabled: false}'

      SPRING_CLOUD_SKIPPER_CLIENT_SERVER_URI: (("https://uas-skipper-server%UAS_DEV_SUFFIX%." .context.imports.cf.deprecated.app_domain "/api" ))
      SPRING_CLOUD_DATAFLOW_SERVER_URI: (("https://uas-dataflow-server%UAS_DEV_SUFFIX%." .context.imports.cf.deprecated.app_domain ))
      SPRING_CLOUD_DATAFLOW_APPLICATIONPROPERTIES_TASK_SPRING_DATASOURCE_HIKARI_MAXIMUMPOOLSIZE: 2
      SPRING_CLOUD_DATAFLOW_APPLICATIONPROPERTIES_TASK_SPRING_DATASOURCE_HIKARI_MINIMUMIDLE: 1
      SPRING_DATASOURCE_HIKARI_MAXIMUMPOOLSIZE: 10
      SPRING_DATASOURCE_HIKARI_MINIMUMIDLE: 2

      SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_INTROSPECTION-URI: "${vcap.services.uas-xsuaa.credentials.url}/introspect"
      SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT-ID: "${vcap.services.uas-xsuaa.credentials.clientid}"
      SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT-SECRET: "${vcap.services.uas-xsuaa.credentials.clientsecret}"

      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_USER_NAME_ATTRIBUTE: user_name
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_USER_INFO_URI: "${vcap.services.uas-xsuaa.credentials.url}/userinfo"
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_AUTHORIZATION_URI: "${vcap.services.uas-xsuaa.credentials.url}/oauth/authorize"
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_TOKEN_URI: "${vcap.services.uas-xsuaa.credentials.url}/oauth/token"

      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_CLIENT_ID: "${vcap.services.uas-xsuaa.credentials.clientid}"
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_CLIENT_SECRET: "${vcap.services.uas-xsuaa.credentials.clientsecret}"
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_REDIRECT_URI: "{baseUrl}/login/oauth2/code/{registrationId}"
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_AUTHORIZATION_GRANT_TYPE: authorization_code
      # new environmental variables
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_SCOPE: 'openid,dataflow.create,dataflow.deploy,dataflow.destroy,dataflow.manage,dataflow.modify,dataflow.schedule,dataflow.view'
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_UAA_JWK_SET_URI: "${vcap.services.uas-xsuaa.credentials.url}/token_keys"
      SPRING_SECURITY_OAUTH2_AUTHORIZATION_CHECK_TOKEN_ACCESS: 'isAuthenticated()'

      SPRING_APPLICATION_JSON: (( asjson(.spring-application-yaml) ))

[DanFrei]

Hello @corneil

Thanks again for your kind assistance.
Unfortunately, after adding the allegedly missing properties, I'm still not able to login to the SCDF server as I'm retrieved with the same exception:

e that requires authentication. 2023-02-12T23:36:03.28+0000 [APP/PROC/WEB/1] OUT org.springframework.security.authentication.ProviderNotFoundException: No AuthenticationProvider found for org.springframework.security.oauth2.client.authentication.OAuth2LoginAuthenticationToken 2023-02-12T23:36:03.28+0000 [APP/PROC/WEB/1] OUT at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:234) 2023-02-12T23:36:03.28+0000 [APP/PROC/WEB/1] OUT at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:201) 2023-02-12T23:36:03.28+0000 [APP/PROC/WEB/1] OUT at org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter.attemptAuthentication(OAuth2LoginAuthenticationFilter.java:195) 2023-02-12T23:36:03.28+0000 [APP/PROC/WEB/1] OUT at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:227) 2023-02-12T23:36:03.28+0000 [APP/PROC/WEB/1] OUT at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:217) 2023-02-12T23:36:03.28+0000 [APP/PROC/WEB/1] OUT at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)

I've tried also changing the environmental variables so it won't have 'dash' in the names where it should be with an 'underscore' and yet it haven't worked (actually I've also tried setting each env property once with a dash and additionally with an underscore for just in case but that didn't help either - kindly see attachment).

BTW -In my case, setting SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_UAA_SCOPE was possible only with value: 'openId' (els-wise, it will fail with bad scope error)