Spring Oauth2 Authorization_Grant - 令牌後無法訪問資源 - 用戶匿名

Question

我試圖通過授權授權流與春天來保護我的REST Api。

我可以得到（與郵差）訪問令牌，我把授權與承載頭，但我不能訪問資源，因爲Spring Security的告訴我說：

2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository[186] - HttpSession returned null object for SPRING_SECURITY_CONTEXT 
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository[116] - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@6e24700e. A new one will be created. 
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.h.writers.HstsHeaderWriter[130] - Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@3e385c64 
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.security.web.FilterChainProxy[325] - /api/user at position 11 of 14 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' 
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.a.AnonymousAuthenticationFilter[100] - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: B1FF11055AA4F347AB8AA7B6E467D93F; Granted Authorities: ROLE_ANONYMOUS' 
2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor[219] - Secure object: FilterInvocation: URL: /api/user; Attributes: [authenticated] 
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor[348] - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9057bc48: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: B1FF11055AA4F347AB8AA7B6E467D93F; Granted Authorities: ROLE_ANONYMOUS 
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.access.vote.AffirmativeBased[66] - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@53b3549c, returned: -1 
    2017-04-06 17:36:33 [http-nio-8080-exec-9] DEBUG o.s.s.w.a.ExceptionTranslationFilter[173] - Access is denied (user is anonymous); redirecting to authentication entry point 
    org.springframework.security.access.AccessDeniedException: Access is denied 

所以基本上，有後獲得訪問令牌，如果我使用它，我將是一個匿名用戶，主要是因爲SPRING_SECURITY_CONTEXT爲空...

這是我ResourceServer配置

@EnableResourceServer 
@EnableGlobalMethodSecurity(prePostEnabled=true) 
public class ResourceServerConfig extends ResourceServerConfigurerAdapter{ 

    private final Logger logger = LoggerFactory.getLogger(ResourceServerConfig.class); 

    @Autowired 
    DataSource dataSource; 

    @Override 
    public void configure(HttpSecurity http) throws Exception { 
       logger.debug("Api security configured"); 
       http  
       .antMatcher("/api/**") 
       .authorizeRequests() 
       .anyRequest().access("hasRole('USER')") 
       .and().exceptionHandling().authenticationEntryPoint(new Http403ForbiddenEntryPoint()) 
       .and().httpBasic(); 
      } 

    @Bean 
     public TokenStore tokenStore() { 
      return new JdbcTokenStore(dataSource); 
     } 

    @Override 
     public void configure(ResourceServerSecurityConfigurer resources) throws Exception { 

      resources.tokenStore(tokenStore()); 
     } 
} 

這一個是驗證服務器

@Configuration 
@EnableAuthorizationServer 
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter { 

    @Autowired 
    DataSource dataSource; 

    @Autowired 
    @Qualifier("authenticationManagerBean") 
    private AuthenticationManager authManager; 

    @Override 
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception { 
     oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()"); 
    } 

    @Override 
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
     clients.jdbc(dataSource); 
    } 

    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { 

     endpoints.tokenStore(tokenStore()).authenticationManager(authManager); 

    } 

    @Bean 
    public TokenStore tokenStore() { 
     return new JdbcTokenStore(dataSource); 
    } 

} 

我試圖訪問/API /用戶這個權威性Bearer 77a226bf-74a4-4a89-b2a6-e130c215566b這些來自auth服務器令牌請求與用戶登錄後...

怎麼了？

Answer 1

我認爲用戶角色沒有從數據庫中獲取。 必須定義角色列嗎？

這將幫助你： https://dzone.com/articles/spring-security-4-authenticate-and-authorize-users

Answer 2

我已經更新春天啓動從1.4到1.5後有完全一樣的問題。該問題已通過禁用啓動的自動配置黑魔法解決。

@EnableAutoConfiguration(exclude = {OAuth2AutoConfiguration.class}) 

我相信他們已經添加了一些新的~~錯誤~~功能，打破舊的應用程序配置。