spring-boot OAuth2客戶端配置

我嘗試使用spring-boot授權流授權流實現OAuth2客戶端。但它不起作用。spring-boot OAuth2客戶端配置

「http://external_server/oauth/authorize」被調用，但沒有添加GET參數。

有沒有人知道下面的配置有什麼問題？

驗證提供程序由doorkeeper實現，並且它已經在工作。因此WebSecurityConfiguration中的URL常量是正確的。

@Configuration 
@EnableWebMvcSecurity 
@EnableOAuth2Client 
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { 

    private static final String AUTH_ENDPOINT = "http://external_server"; 
    private static final String LOGIN_URL = AUTH_ENDPOINT + "https://stackoverflow.com/users/sign_in"; 
    private static final String LOGOUT_URL = AUTH_ENDPOINT + "/sign_out"; 

    private static final String AUTH_URL = AUTH_ENDPOINT + "/oauth/authorize"; 
    private static final String ACCESS_TOKEN_URL = AUTH_ENDPOINT + "/oauth/token"; 

    @Autowired OAuth2ClientContext oAuth2ClientContext; 

    /** 
    * for specific api 
    */ 
    @Bean public RestTemplate restTemplate() { 
    return new RestTemplate(); 
    } 

    /** 
    * for accessing protected resource 
    */ 
    @Bean public OAuth2RestTemplate oAuth2RestTemplate() { 
    return new OAuth2RestTemplate(resource(), oAuth2ClientContext); 
    } 

    @Bean protected OAuth2ProtectedResourceDetails resource() { 

    AuthorizationCodeResourceDetails resource = new AuthorizationCodeResourceDetails(); 
    resource.setClientId("_xxx_"); 
    resource.setClientSecret("_yyy_"); 
    resource.setUserAuthorizationUri(AUTH_URL); 
    resource.setAccessTokenUri(ACCESS_TOKEN_URL); 

    return resource; 
    } 

    @Override public void configure(WebSecurity web) throws Exception { 
    web.debug(true).ignoring().antMatchers("/webjars/**", "/css/**"); 
    } 

    @Override protected void configure(HttpSecurity http) throws Exception { 
    //@formatter:off 
    http.csrf().disable().authorizeRequests() 
     .antMatchers("/", "/callback") 
     .permitAll() 
     .anyRequest() 
     .authenticated(); 

    http.formLogin() 
     .loginPage(AUTH_URL) 
     .loginProcessingUrl(LOGIN_URL); 

    http.httpBasic() 
     .disable(); 
    //@formatter:on 
    } 
}

來源

2015-06-19 Yuki Yoshida

OAuth2ProtectedResourceDetails在OAuth2RestTemplate設置，以便它會知道什麼樣的補助流你想用。事實上，你並沒有利用它。 –

@ bajada93感謝您的評論！我修復了Configuration類來注入OAuth2RestTemplate，但仍然無法工作。 –

您需要添加一個[OAuth2ClientAuthenticationProcessingFilter]（https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/ oauth2/client/filter/OAuth2ClientAuthenticationProcessingFilter.java）添加到Spring Security Filter Chain中，並在其中注入OAuth2RestTemplate。這應該夠了吧。 –

默認情況下，只啓用POST方法。您可能需要在AuthorizationConfig中包含GET方法。

.allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST);

會是這樣：

@Configuration 
@EnableAuthorizationServer 
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter { 
    .... 
    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer endpoints){ 
     endpoints.authenticationManager(authenticationManager) 
       .allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST); 
    } 
}

在春天的Oauth的源代碼，我們有：

private Set<HttpMethod> allowedTokenEndpointRequestMethods() { 
     // HTTP POST should be the only allowed endpoint request method by default. 
     if (allowedTokenEndpointRequestMethods.isEmpty()) { 
      allowedTokenEndpointRequestMethods.add(HttpMethod.POST); 
     } 
     return allowedTokenEndpointRequestMethods; 
    }

來源

2018-02-14 18:15:32

spring-boot OAuth2客戶端配置

回答

相關問題