无法使用 Spring Security OAuth 2.0 获取 access_token (404)

Question

我正在使用 Spring 4.2.1.RELEASE、Spring Security 4.0.2.RELEASE 和 Spring Security OAuth 2.0.7.RELEASE 构建一个带有 RESTful API 的 Web 应用程序。

以前我的登录功能不是 100% RESTful，因为我使用 cookie 进行身份验证。

现在我需要通过 OAuth 端点使用令牌身份验证迁移到纯 RESTful。

我遵循了许多指南，尤其是这个：https://www.youtube.com/watch?v=LnJsspvxE1c

当我尝试获取访问令牌时，我向 Postman 发出以下请求。

HTTP GET
http://localhost:8080/oauth/token?grant_type=password&client_id=trusted-client&username=name&password=pass

但我总是收到 404 Not Found。

我找不到哪里错了。

下面是我的spring安全配置文件。

```

<beans:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:beans="http://www.springframework.org/schema/beans" 
         xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans 
            http://www.springframework.org/schema/beans/spring-beans-4.0.xsd 
            http://www.springframework.org/schema/security 
            http://www.springframework.org/schema/security/spring-security-4.0.xsd  
            http://www.springframework.org/schema/security/oauth2
            http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
            http://www.springframework.org/schema/context
            http://www.springframework.org/schema/context/spring-context-3.1.xsd">


<!-- Definition of the Authentication Service -->
<http pattern="/oauth/token" 
      create-session="stateless" 
      authentication-manager-ref="clientAuthenticationManager"
      xmlns="http://www.springframework.org/schema/security">
    <intercept-url pattern="/oauth/token" 
                   access="isAuthenticated()"/>
    <anonymous enabled="false"/>
    <http-basic entry-point-ref="clientAuthenticationEntryPoint"/>

    <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/>

    <access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>



<!-- Protected resources -->
<http auto-config="true" 
      use-expressions="true"
      pattern="/api/**"
      create-session="never"
      entry-point-ref="oauthAuthenticationEntryPoint"
      access-decision-manager-ref="accessDecisionManager"
      xmlns="http://www.springframework.org/schema/security">
    <anonymous enabled="false"/>
    <intercept-url pattern="/api/**" access="ROLE_USER" />
    <custom-filter ref="resourceServerFilter"
                   before="PRE_AUTH_FILTER"/>
    <access-denied-handler
            ref="oauthAccessDeniedHandler"/>
</http>

<beans:bean id="oauthAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <beans:property name="realmName" value="auth"/>
</beans:bean>

<beans:bean id="clientAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <beans:property name="realmName" value="auth/client"/>
    <beans:property name="typeName" value="Basic"/>
</beans:bean>

<beans:bean 
    id="oauthAccessDeniedHandler"
    class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>

<beans:bean id="clientCredentialsTokenEndpointFilter"
      class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <beans:property name="authenticationManager" 
                    ref="clientAuthenticationManager"/>
</beans:bean>

<beans:bean id="accessDecisionManager" 
            class="org.springframework.security.access.vote.UnanimousBased"
            xmlns="http://www.springframework.org/schema/beans">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/>
            <bean class="org.springframework.security.access.vote.RoleVoter"/>
            <bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/>
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
        </list>
    </constructor-arg>
</beans:bean>

<!-- Authentication in config file -->
<authentication-manager id="clientAuthenticationManager" 
                        xmlns="http://www.springframework.org/schema/security">
    <authentication-provider user-service-ref="clientDetailsUserService"/>
</authentication-manager>

<beans:bean id="passwordEncoder" 
    class="org.springframework.security.authentication.encoding.Md5PasswordEncoder">
</beans:bean>

<authentication-manager alias="authenticationManager">
    <authentication-provider user-service-ref="customUserService">
        <password-encoder ref="passwordEncoder" />         
    </authentication-provider>
</authentication-manager>

<beans:bean id="clientDetailsUserService"
      class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
    <beans:constructor-arg ref="clientDetails"/>
</beans:bean>

<!-- Token Store  -->
<beans:bean id="tokenStore" 
      class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore"/>

<beans:bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <beans:property name="tokenStore" ref="tokenStore"/>
    <beans:property name="supportRefreshToken" value="true"/>
    <beans:property name="clientDetailsService" ref="clientDetails"/>
    <beans:property name="accessTokenValiditySeconds" value="10"/>
</beans:bean>

<beans:bean id="oAuth2RequestFactory"
    class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
    <beans:constructor-arg ref="clientDetails" />
</beans:bean>

<beans:bean id="userApprovalHandler"
      class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
    <beans:property name="tokenStore" ref="tokenStore"/>
    <beans:property name="requestFactory" ref="oAuth2RequestFactory" />
    <beans:property name="clientDetailsService" ref="clientDetails"/>
</beans:bean>

<!-- Token management -->
<oauth:authorization-server client-details-service-ref="clientDetails" 
                            token-services-ref="tokenServices"
                            user-approval-handler-ref="userApprovalHandler"
                            token-endpoint-url="/oauth/token">
    <oauth:authorization-code/>
    <oauth:implicit/>
    <oauth:refresh-token/>
    <oauth:client-credentials/>
    <oauth:password/>
</oauth:authorization-server>

<oauth:resource-server id="resourceServerFilter"
                   resource-id="auth"
                   token-services-ref="tokenServices"/>

<!-- Client Definition -->
<oauth:client-details-service id="clientDetails">

    <oauth:client client-id="trusted-client"
                  authorized-grant-types="password,authorization_code,refresh_token,implicit,redirect"
                  authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT"
                  redirect-uri="/secure/index"
                  scope="read,write,trust"
                  access-token-validity="30"
                  refresh-token-validity="600"/>

</oauth:client-details-service>

<global-method-security pre-post-annotations="enabled"
                        secured-annotations="enabled" 
                        proxy-target-class="true" order="1" >
    <expression-handler ref="oauthExpressionHandler"/>
</global-method-security>

<oauth:expression-handler id="oauthExpressionHandler"/>
<oauth:web-expression-handler id="oauthWebExpressionHandler"/>

Answer 1

授权类型password 期望POST 查询/oauth/token，而不是GET。 所以应该是：

curl -X POST -d 'grant_type=password&client_id=trusted-client&username=name&password=pass' 'http://localhost:8080/oauth/token'

此外，您的 oauth/token 端点仅适用于 isAuthenticated 用户：

<intercept-url pattern="/oauth/token" access="isAuthenticated()"/>

但据我了解，您以匿名用户的身份拨打电话。