角色層次結構和OAuth2使用Spring Boot的安全性

我知道有大量有關角色層次結構的線程，但我找不到任何與OAuth2結合的示例。角色層次結構和OAuth2使用Spring Boot的安全性

所以，多數線程的點，我需要實現RoleHierarchy豆：

Beans.java

@EnableJpaRepositories(basePackages = "com.template.service.repository") 
@EnableAspectJAutoProxy 
@ComponentScan 
@Configuration 
public class Beans { 
@Bean 
public ItemService itemsService(ItemsRepository itemsRepository) { 
    return new ItemService(itemsRepository); 
} 

@Bean 
public RoleHierarchy roleHierarchy(){ 
    RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl(); 
    roleHierarchy.setHierarchy("ROLE_SUPREME > ROLE_DEVELOPER ROLE_DEVELOPER > ROLE_ADMIN ROLE_ADMIN > ROLE_USER"); 
    return roleHierarchy; 
} 

@Bean 
public DtoMapper dtoMapper() { 
    return new DtoMapper(); 
} 
}

接下來，我需要@Autowire這個bean我WebSecurityConfigurerAdapter。但是，因爲我使用的是OAuth2安全性，因此我在ResourceServerConfigurerAdapter內配置了HttpSecurity。

OAuth2.java

public class OAuth2 { 
@EnableAuthorizationServer 
@Configuration 
@ComponentScan 
public static class AuthorizationServer extends AuthorizationServerConfigurerAdapter { 

    @Autowired 
    private AuthenticationManager authenticationManagerBean; 
    @Autowired 
    private UserDetailsService userDetailsService; 

    @Override 
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
     clients.inMemory() 
       .withClient("trusted_client") 
       .authorizedGrantTypes("password", "refresh_token") 
       .scopes("read", "write"); 
    } 

    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { 
     endpoints.authenticationManager(authenticationManagerBean).userDetailsService(userDetailsService); 
    } 

    @Override 
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception { 
     security.allowFormAuthenticationForClients(); 
    } 
} 

@EnableResourceServer 
@Configuration 
@ComponentScan 
public static class ResourceServer extends ResourceServerConfigurerAdapter { 

    @Autowired 
    private RoleHierarchy roleHierarchy; 

    private SecurityExpressionHandler<FilterInvocation> webExpressionHandler() { 
     OAuth2WebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new OAuth2WebSecurityExpressionHandler(); 
     defaultWebSecurityExpressionHandler.setRoleHierarchy(roleHierarchy); 
     return defaultWebSecurityExpressionHandler; 
    } 

    @Override 
    public void configure(HttpSecurity http) throws Exception { 
     http 
       .authorizeRequests().expressionHandler(webExpressionHandler()) 
       .antMatchers("/api/**").hasRole("DEVELOPER"); 
    } 
} 
}

Security.java

@EnableWebSecurity 
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) 
@Configuration 
@ComponentScan 
public class Security extends WebSecurityConfigurerAdapter { 

@Autowired 
private UserDetailsService userDetailsService; 

@Bean 
public JpaAccountDetailsService userDetailsService(AccountsRepository accountsRepository) { 
    return new JpaAccountDetailsService(accountsRepository); 
} 

@Override 
protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); 
} 

@Bean 
@Override 
public AuthenticationManager authenticationManagerBean() throws Exception { 
    return super.authenticationManagerBean(); 
} 

@Bean 
public PasswordEncoder passwordEncoder(){ 
    return new BCryptPasswordEncoder(); 
} 
}

但是層次不工作。與SUPREME用戶憑據請求結尾：

{ 
    "error": "access_denied", 
    "error_description": "Access is denied" 
}

當我切換到hasRole("DEVELOPER")hasRole("SUPREME") - 一切正常。

我使用Spring 1.5.2引導和Spring安全的OAuth 2.1.0.RELEASE

UPDATE

當我評論所有OAuth2.java類和移動webExpressionHandler()方法簽名Security.java類 - 角色層次工作正常。那麼OAuth2資源服務器發生了什麼？

來源

2017-03-16 ilovkatie

您如何看待ResourceServer中的這種方法？

@Bean 
    public RoleHierarchyImpl roleHierarchy() { 
     RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl(); 
     roleHierarchy.setHierarchy("ROLE_SUPREME > ROLE_DEVELOPER ROLE_DEVELOPER > ROLE_ADMIN ROLE_ADMIN > ROLE_USER")   return roleHierarchy; 
    } 


    @Bean 
    public RoleHierarchyVoter roleVoter() { 
     return new RoleHierarchyVoter(roleHierarchy()); 
    } 


    @Bean 
    public AffirmativeBased defaultOauthDecisionManager(RoleHierarchy roleHierarchy){ // 

     List<AccessDecisionVoter> decisionVoters = new ArrayList<AccessDecisionVoter>(); 

     // webExpressionVoter 
     OAuth2WebSecurityExpressionHandler expressionHandler = new OAuth2WebSecurityExpressionHandler(); 
     expressionHandler.setRoleHierarchy(roleHierarchy); 
     WebExpressionVoter webExpressionVoter = new WebExpressionVoter(); 
     webExpressionVoter.setExpressionHandler(expressionHandler); 
     decisionVoters.add(webExpressionVoter); 
     decisionVoters.add(roleVoter()); 
     return new AffirmativeBased(decisionVoters); 
    }

而且

http 
       .authorizeRequests() 
       .accessDecisionManager(defaultOauthDecisionManager(roleHierarchy())) 
       //etc...

這可能是更好地組織和封裝，但你知道我的意思，不是嗎？......我認爲它工作正常。我希望這會幫助你...

來源

2017-04-21 16:30:13

角色層次結構和OAuth2使用Spring Boot的安全性

回答

相關問題