春季安全的OAuth2 - 定製ClientDetailsS​​ervice

Question

我目前正在爲一個OAuth2驗證程序的彈簧應用程序，但我得到了一些問題，實現自定義ClientDetailsS​​ervice。

我不能使用普通的inMemory甌JDBC clientDetailsS​​ervice因爲客戶端的信息arn't存儲在我的應用程序，我讓他們從外部Web服務。但是當我設置一個自定義的ClientDetailService時，我不再獲得access_confirmation頁面（我得到一個空白頁面）。

要告訴你我的問題，我不使用我的應用程序，但是從官方春季香草測試 - 安全的OAuth項目spring-security-oauth

這裏的應用程序代碼：

@SpringBootApplication 
@EnableResourceServer 
@RestController 
public class Application { 

    public static void main(String[] args) { 
     SpringApplication.run(Application.class, args); 
    } 

    @RequestMapping("/") 
    public String home() { 
     return "Hello World"; 
    } 

    @RequestMapping(value = "/", method = RequestMethod.POST) 
    @ResponseStatus(HttpStatus.CREATED) 
    public String create(@RequestBody MultiValueMap<String, String> map) { 
     return "OK"; 
    } 

    @Configuration 
    @EnableAuthorizationServer 
    protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter { 

     @Autowired 
     private AuthenticationManager authenticationManager; 

     @Override 
     public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { 
      endpoints.authenticationManager(authenticationManager); 
     } 

     @Override 
     public void configure(AuthorizationServerSecurityConfigurer security) throws Exception { 
      security.checkTokenAccess("isAuthenticated()"); 
     } 

     public ClientDetailsService clientDetailsService() { 
      return new ClientDetailsService() { 
       @Override 
       public ClientDetails loadClientByClientId(String clientId) throws ClientRegistrationException { 
        BaseClientDetails details = new BaseClientDetails(); 
        details.setClientId(clientId); 
        details.setAuthorizedGrantTypes(Arrays.asList("authorization_code")); 
        details.setScope(Arrays.asList("read, trust")); 
        details.setResourceIds(Arrays.asList("oauth2-resource")); 
        Set<GrantedAuthority> authorities = new HashSet<GrantedAuthority>(); 
        authorities.add(new SimpleGrantedAuthority("ROLE_CLIENT")); 
        details.setAuthorities(authorities); 
        return details; 
       } 
      }; 
     } //*/ 


     @Override 
     public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
      // @formatter:off 

      clients.withClientDetails(clientDetailsService()); 

      /*clients.inMemory() 
       .withClient("test") 
        .authorizedGrantTypes("authorization_code") 
        .authorities("ROLE_CLIENT") 
        .scopes("read", "trust") 
        .resourceIds("oauth2-resource"); 
      //*/ 
      // @formatter:on 
     } 
    } 

} 

正如你可以看到我添加了我的自定義clientDetailsS​​ervice並更改了ClientDetailsS​​erviceconfigurer配置，以設置它而不是內存clientDetailsS​​ervice。

我的問題是，當試圖讓我的令牌我沒有得到我的access_confirmation頁面了我登錄的用戶之後。

，我發現我的問題，我在我的clientDetails的範圍的定義是假的。我有Arrays.asList（ 「讀信」），而不是Arrays.asList（ 「讀取」， 「信任」）

難道我錯過了什麼？我是否必須在其他地方設置自定義的clientDetailsS​​ervice？

Answer 1

試着改變你的ClientDetails IMPL像這樣：

public ClientDetailsService clientDetailsService() { 
     return new ClientDetailsService() { 
      @Override 
      public ClientDetails loadClientByClientId(String clientId) throws ClientRegistrationException { 
       BaseClientDetails details = new BaseClientDetails(); 
       details.setClientId(clientId); 
       details.setAuthorizedGrantTypes(Arrays.asList("authorization_code")); 
       details.setScope(Arrays.asList("read, trust")); 
       details.setRegisteredRedirectUri(Collections.singleton("http://anywhere.com")); 
       details.setResourceIds(Arrays.asList("oauth2-resource")); 
       Set<GrantedAuthority> authorities = new HashSet<GrantedAuthority>(); 
       authorities.add(new SimpleGrantedAuthority("ROLE_CLIENT")); 
       details.setAuthorities(authorities); 
       return details; 
      } 
     }; 
    } //*/