無法使spring oauth2服務器正常工作

Question

似乎無法使spring oauth2服務器配置成功通過令牌進行身份驗證。

我覺得我很想念一些東西，但我會採取任何指針。

我正在嘗試密碼授予。我一直運行404/on/oauth /令牌。見我的配置及以下捲曲（userAuthenticationProvider由@Configuration注入的自定義商）：

配置：

<beans xmlns="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2" 
xmlns:sec="http://www.springframework.org/schema/security" xmlns:mvc="http://www.springframework.org/schema/mvc" 
xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 
http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd 
http://www.springframework.org/schema/mvc 
http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd 
http://www.springframework.org/schema/security 
http://www.springframework.org/schema/security/spring-security-3.2.xsd 
http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd"> 


<oauth:authorization-server 
    client-details-service-ref="clientDetails" token-services-ref="tokenServices" 
    user-approval-handler-ref="userApprovalHandler"> 
    <oauth:authorization-code /> 
    <oauth:implicit /> 
    <oauth:refresh-token /> 
    <oauth:client-credentials /> 
    <oauth:password authentication-manager-ref="clientAuthenticationManager" /> 
</oauth:authorization-server> 

<oauth:client-details-service id="clientDetails"> 
    <oauth:client client-id="my-trusted-client" 
     authorized-grant-types="password,authorization_code,refresh_token,implicit" 
     authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT, ROLE_USER" scope="read,write,trust" 
     access-token-validity="60" /> 
    <oauth:client client-id="my-trusted-client-with-secret" 
     authorized-grant-types="password,authorization_code,refresh_token,implicit" 
     secret="somesecret" authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT, ROLE_USER" 
     scope="read,write,trust" /> 
    <oauth:client client-id="my-client-with-secret" 
     authorized-grant-types="client_credentials" authorities="ROLE_CLIENT, ROLE_USER" 
     scope="read" secret="secret" /> 
    <oauth:client client-id="my-less-trusted-client" 
     authorized-grant-types="authorization_code,implicit" authorities="ROLE_CLIENT, ROLE_USER" /> 
    <oauth:client client-id="my-less-trusted-autoapprove-client" 
     authorized-grant-types="implicit" authorities="ROLE_CLIENT, ROLE_USER" /> 
    <oauth:client client-id="my-client-with-registered-redirect" 
     authorized-grant-types="authorization_code,client_credentials" 
     authorities="ROLE_CLIENT, ROLE_USER" redirect-uri="http://anywhere?key=value" 
     scope="read,trust" /> 
    <oauth:client client-id="my-untrusted-client-with-registered-redirect" 
     authorized-grant-types="authorization_code" authorities="ROLE_CLIENT, ROLE_USER" 
     redirect-uri="http://anywhere" scope="read" /> 
    <oauth:client client-id="tonr" resource-ids="sparklr" 
     authorized-grant-types="authorization_code,implicit" authorities="ROLE_CLIENT" 
     scope="read,write" secret="secret" /> 
</oauth:client-details-service> 

<bean id="clientDetailsUserService" 
    class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"> 
    <constructor-arg ref="clientDetails" /> 
</bean> 

<bean id="oauthAccessDeniedHandler" 
    class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /> 

<bean id="tokenStore" 
    class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore" /> 

<bean id="tokenServices" 
    class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"> 
    <property name="tokenStore" ref="tokenStore" /> 
    <property name="supportRefreshToken" value="true" /> 
    <property name="clientDetailsService" ref="clientDetails" /> 
</bean> 

<bean id="oAuth2RequestFactory" 
    class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"> 
    <constructor-arg ref="clientDetails" /> 
</bean> 

<bean id="userApprovalHandler" 
    class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler"> 
    <property name="tokenStore" ref="tokenStore" /> 
    <property name="requestFactory" ref="oAuth2RequestFactory" /> 
</bean> 

<bean id="clientCredentialsTokenEndpointFilter" 
    class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"> 
    <property name="authenticationManager" ref="clientAuthenticationManager" /> 
</bean> 

<http pattern="/oauth/token" create-session="stateless" 
    authentication-manager-ref="clientAuthenticationManager" 
    xmlns="http://www.springframework.org/schema/security"> 
    <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /> 
    <anonymous enabled="false" /> 
    <http-basic entry-point-ref="clientAuthenticationEntryPoint" /> 
    <!-- include this only if you need to authenticate clients via request 
     parameters --> 
    <custom-filter ref="clientCredentialsTokenEndpointFilter" 
     before="BASIC_AUTH_FILTER" /> 
    <access-denied-handler ref="oauthAccessDeniedHandler" /> 
</http> 
<http pattern="/oauth/check_token" create-session="stateless" 
    authentication-manager-ref="clientAuthenticationManager" 
    xmlns="http://www.springframework.org/schema/security"> 
    <anonymous enabled="false" /> 
    <http-basic entry-point-ref="oauthAuthenticationEntryPoint" /> 
    <access-denied-handler ref="oauthAccessDeniedHandler" /> 
</http> 

<authentication-manager id="clientAuthenticationManager" 
    xmlns="http://www.springframework.org/schema/security"> 
    <authentication-provider user-service-ref="clientDetailsUserService" /> 
</authentication-manager> 

<authentication-manager 
    xmlns="http://www.springframework.org/schema/security" alias="userAuthenticationManager"> 
    <authentication-provider ref="userAuthenticationProvider"> 
     <!-- <user-service> <user name="admin" password="adminpassword" authorities="ROLE_USER" 
      disabled="true" locked="true" /> <user name="user" password="userpassword" 
      authorities="ROLE_USER" /> </user-service> --> 
    </authentication-provider> 
</authentication-manager> 

<bean id="clientAuthenticationEntryPoint" 
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
    <!-- <property name="realmName" value="test" /> --> 
</bean> 
<bean id="oauthAuthenticationEntryPoint" 
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"> 
    <property name="realmName" value="test" /> 
</bean> 

<!-- ACCESS DECISION AND ROLE VOTERS --> 

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" 
    xmlns="http://www.springframework.org/schema/beans"> 
    <constructor-arg> 
     <list> 
      <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /> 
     </list> 
    </constructor-arg> 
</bean> 

<sec:global-method-security 
    jsr250-annotations="enabled" access-decision-manager-ref="accessDecisionManager" /> 

捲曲：

curl my-trusted-client-with-secret:somesecret@localhost:8080/oauth/token -d grant_type=password -d username=admin -d password=adminpassword 

我會對任何錯誤採取任何指示。

Answer 1

即使在Spring安全篩選器鏈對我的客戶端進行了身份驗證之後，我仍然在404上接收/ oauth/token，因爲部署描述符ie web.xml缺少Spring Dispatcher servlet配置。增加了以下內容，並且都很好：

<servlet> 
    <servlet-name>spring</servlet-name> 
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> 
    <init-param> 
     <param-name>contextConfigLocation</param-name> 
     <param-value>classpath:META-INF/spring/servlet-context.xml</param-value> 
    </init-param> 
    <load-on-startup>2</load-on-startup> 
</servlet> 
<servlet-mapping> 
    <servlet-name>spring</servlet-name> 
    <url-pattern>/oauth/token</url-pattern> 
</servlet-mapping>