使用WSO2身份驗證服務器的Spring Cloud安全

Question

我正在嘗試使用具有外部本地身份驗證服務器（WSO2身份驗證服務器）的spring-cloud-security進行安全保護的spring-boot-web應用程序。我們正在使用OAuth2 OpenID Connect（JWT令牌）。

我的應用程序將重定向到WSO2服務器，只適用於/ oauth2/authorize請求，但在嘗試將authorization_code轉換爲access_token時失敗。 spring-boot報告401認證錯誤。

我相信這是因爲oauth2/token端點需要基本認證。

有人可以指導我如何使/ oauth2 /令牌請求使用基本認證標題與春季雲安全？

這裏是我的application.yml

spring: 
    oauth2: 
    sso: 
     home: 
     secure: false 
     path: /,/**/*.html 
    client: 
     accessTokenUri: https://URI:9443/oauth2/token 
     userAuthorizationUri: https://URI:9443/oauth2/authorize 
     clientId: id 
     clientSecret: secret 
     scope: openid 
     clientAuthenticationScheme: header 
    resource: 
     userInfoUri: https://URI:9443/oauth2/userinfo?schema=openid 

這裏是我的簡單application.java

package demo; 

import java.io.IOException; 

import javax.servlet.Filter; 
import javax.servlet.FilterChain; 
import javax.servlet.ServletException; 
import javax.servlet.http.Cookie; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 

import org.springframework.boot.SpringApplication; 
import org.springframework.boot.autoconfigure.SpringBootApplication; 
import org.springframework.cloud.netflix.zuul.EnableZuulProxy; 
import org.springframework.cloud.security.oauth2.sso.EnableOAuth2Sso; 
import org.springframework.cloud.security.oauth2.sso.OAuth2SsoConfigurerAdapter; 
import org.springframework.context.annotation.Configuration; 
import org.springframework.security.config.annotation.web.builders.HttpSecurity; 
import org.springframework.security.web.csrf.CsrfFilter; 
import org.springframework.security.web.csrf.CsrfToken; 
import org.springframework.security.web.csrf.CsrfTokenRepository; 
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository; 
import org.springframework.web.filter.OncePerRequestFilter; 
import org.springframework.web.util.WebUtils; 

@SpringBootApplication 
@EnableZuulProxy 
@EnableOAuth2Sso 
public class SpringOauth2WithWso2Application { 

    public static void main(String[] args) { 
     SpringApplication.run(SpringOauth2WithWso2Application.class, args); 
    } 

    @Configuration 
    protected static class SecurityConfiguration extends OAuth2SsoConfigurerAdapter { 

     @Override 
      public void match(RequestMatchers matchers) { 
      matchers.anyRequest(); 
      } 

      @Override 
      public void configure(HttpSecurity http) throws Exception { 
      http.authorizeRequests().antMatchers("/index.html", "/home.html", "/") 
       .permitAll().anyRequest().authenticated().and().csrf() 
       .csrfTokenRepository(csrfTokenRepository()).and() 
       .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class); 
      } 



     private Filter csrfHeaderFilter() { 
      return new OncePerRequestFilter() { 
       @Override 
       protected void doFilterInternal(HttpServletRequest request, 
         HttpServletResponse response, FilterChain filterChain) 
         throws ServletException, IOException { 
        CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class 
          .getName()); 
        if (csrf != null) { 
         Cookie cookie = WebUtils.getCookie(request, "XSRF-TOKEN"); 
         String token = csrf.getToken(); 
         if (cookie == null || token != null 
           && !token.equals(cookie.getValue())) { 
          cookie = new Cookie("XSRF-TOKEN", token); 
          cookie.setPath("/"); 
          response.addCookie(cookie); 
         } 
        } 
        filterChain.doFilter(request, response); 
       } 
      }; 
     } 

     private CsrfTokenRepository csrfTokenRepository() { 
      HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository(); 
      repository.setHeaderName("X-XSRF-TOKEN"); 
      return repository; 
     } 
    } 


} 

Answer 1

雖然需要添加WSO2與證書的Java證書存儲已經提到作爲一個解決方案，以防萬一它需要這樣做的步驟，以及建立mitmproxy，所以你可以檢查交通已記錄在這裏通過模板項目的方式：https://github.com/nicodewet/template-spring-boot-oauth2-wso2-is