自定義URI Oauth2 + Spring安全性 - REST API

Question

我需要使用Oauth2來創建自定義URI的幫助，我使用類似這樣的東西實現了一個。

oauth/token?grant_type=password&client_id=restapp&client_secret=restapp&username=user123&password=pass123 

但我想通過所有的數據使用標題，但我沒有找到任何示例如何做到這一點。

是否有可能？還是值得推薦的？ 非常感謝。

編輯：加我的彈簧security.xml文件

<import resource="/spring-config.xml" />  

<!-- This is default url to get a token from OAuth --> 
<http pattern="/oauth/token" create-session="stateless" 
     authentication-manager-ref="clientAuthenticationManager" 
     xmlns="http://www.springframework.org/schema/security"> 
    <intercept-url pattern="/token" access="IS_AUTHENTICATED_FULLY" /> 
    <anonymous enabled="false" /> 
    <http-basic entry-point-ref="clientAuthenticationEntryPoint" /> 
    <!-- include this only if you need to authenticate clients via request 
    parameters --> 
    <custom-filter ref="clientCredentialsTokenEndpointFilter" 
        after="BASIC_AUTH_FILTER" /> 
    <access-denied-handler ref="oauthAccessDeniedHandler" /> 
</http> 

<!-- This is where we tells spring security what URL should be protected 
and what roles have access to them --> 
<http pattern="/api/prod/**" create-session="never" 
     entry-point-ref="oauthAuthenticationEntryPoint" 
     access-decision-manager-ref="accessDecisionManager" 
     xmlns="http://www.springframework.org/schema/security"> 
    <anonymous enabled="false" /> 
    <intercept-url pattern="/api/prod/**" access="ROLE_APP" /> 
    <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /> 
    <access-denied-handler ref="oauthAccessDeniedHandler" /> 
</http> 


<bean id="oauthAuthenticationEntryPoint" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
    <property name="realmName" value="test" /> 
</bean> 

<bean id="clientAuthenticationEntryPoint" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
    <property name="realmName" value="test/client" /> 
    <property name="typeName" value="Basic" /> 
</bean> 

<bean id="oauthAccessDeniedHandler" 
     class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /> 

<bean id="clientCredentialsTokenEndpointFilter" 
     class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"> 
    <property name="authenticationManager" ref="clientAuthenticationManager" /> 
</bean> 


<!-- Custom User details service which is provide the user data --> 
<bean id="customAuthenticationProvider" 
     class="com.system.rest.natura.resources.security.CustomAuthenticationProvider" /> 


<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" 
     xmlns="http://www.springframework.org/schema/beans"> 
    <constructor-arg> 
     <list> 
      <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /> 
      <bean class="org.springframework.security.access.vote.RoleVoter" /> 
      <bean class="org.springframework.security.access.vote.AuthenticatedVoter" /> 
     </list> 
    </constructor-arg> 
</bean> 

<authentication-manager id="clientAuthenticationManager" 
         xmlns="http://www.springframework.org/schema/security"> 
    <authentication-provider user-service-ref="clientDetailsUserService" /> 

</authentication-manager> 

<authentication-manager alias="authenticationManager" 
         xmlns="http://www.springframework.org/schema/security"> 
    <authentication-provider ref="customAuthenticationProvider" /> 

</authentication-manager> 


<bean id="clientDetailsUserService" 
     class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"> 
    <constructor-arg ref="clientDetails" /> 
</bean> 

<bean id="tokenStore" 
     class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /> 

<bean id="tokenServices" 
     class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"> 
    <property name="tokenStore" ref="tokenStore" /> 
    <property name="supportRefreshToken" value="true" /> 
    <property name="accessTokenValiditySeconds" value="1200" /> 
    <property name="clientDetailsService" ref="clientDetails" /> 
</bean> 

<bean id="userApprovalHandler" 
     class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler"> 
    <property name="tokenServices" ref="tokenServices" /> 
</bean> 

<oauth:authorization-server 
    client-details-service-ref="clientDetails" token-services-ref="tokenServices" 
    user-approval-handler-ref="userApprovalHandler"> 
    <oauth:authorization-code /> 
    <oauth:implicit /> 
    <oauth:refresh-token /> 
    <oauth:client-credentials /> 
    <oauth:password /> 
</oauth:authorization-server> 

<oauth:resource-server id="resourceServerFilter" 
         resource-id="test" token-services-ref="tokenServices" /> 

<oauth:client-details-service id="clientDetails"> 
    <!-- client --> 
    <clientAuthenticationScheme> 

    </clientAuthenticationScheme> 
    <oauth:client client-id="restapp" 
        authorized-grant-types="authorization_code,client_credentials" 
        authorities="ROLE_APP" scope="read,write,trust" secret="secret" /> 

    <oauth:client client-id="restapp" 
        authorized-grant-types="password,authorization_code,refresh_token,implicit" 
        secret="restapp" authorities="ROLE_APP" /> 

</oauth:client-details-service> 

<sec:global-method-security 
    pre-post-annotations="enabled" proxy-target-class="true"> 
    <sec:expression-handler ref="oauthExpressionHandler" /> 
</sec:global-method-security> 

<oauth:expression-handler id="oauthExpressionHandler" /> 
<oauth:web-expression-handler id="oauthWebExpressionHandler" /> 

Answer 1

你嘗試把這個線的src/main/application.yml？

security: 
    oauth2: 
    client: 
     clientAuthenticationScheme: header 

編輯1：

據https://github.com/jirutka/spring-security-oauth-samples/blob/master/tonr/src/main/webapp/WEB-INF/spring/security.xml，在XML你必須有這樣的事情：

<oauth:resource id="facebook" 
       type="authorization_code" 
       client-id="233668646673605" 
       client-secret="33b17e044ee6a4fa383f46ec6e28ea1d" 
       authentication-scheme="query" 
       access-token-uri="https://graph.facebook.com/oauth/access_token" 
       user-authorization-uri="https://www.facebook.com/dialog/oauth" 
       token-name="oauth_token" 
       client-authentication-scheme="form" /> 

其中client-authentication-scheme值header。