【发布时间】：2018-08-29 02:22:29
【问题描述】：
我尝试使用 Spring Boot 2.0.0 和 spring-security-oauth2 2.3.0 创建一个具有自己的登录页面和资源的授权服务器。不幸的是，资源服务器的配置似乎不起作用。与
curl -v localhost:8080/sample
始终将 302 重定向到 localhost:8080/login，无论是否带有令牌。
我的安全配置是
@Configuration
public class SecurityConfiguration {
@Configuration
@Order(1)
@EnableWebSecurity(debug = true)
protected static class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("john").password("{noop}123").roles("User");
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Override
protected void configure(final HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/ping").permitAll()
.antMatchers("/login").permitAll()
.anyRequest().authenticated()
.and()
.csrf()
.and()
.formLogin()
.usernameParameter("username")
.passwordParameter("password")
.loginPage("/login")
.permitAll()
.and()
.rememberMe()
.rememberMeParameter("remember")
.and()
.httpBasic().disable()
.logout().permitAll();
}
}
@Configuration
@EnableResourceServer
@Order(10)
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
private static final String RESOURCE_ID = "Sample";
@Override
public void configure(final ResourceServerSecurityConfigurer resources) throws Exception {
resources.resourceId(RESOURCE_ID);
}
@Override
public void configure(final HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/sample**").authenticated();
}
}
@Configuration
@EnableAuthorizationServer
@Order(Ordered.HIGHEST_PRECEDENCE)
protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
@Autowired
private AuthenticationManager authenticationManager;
@Override
public void configure(final AuthorizationServerSecurityConfigurer security) throws Exception {
security.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
}
@Override
public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory().withClient("ABC").secret("{noop}sec1").autoApprove(true)
.authorizedGrantTypes("authorization_code", "client_credentials", "password", "refresh_token")
.scopes("read", "write")
.redirectUris("http://google.com");
}
@Override
public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints
.tokenStore(new InMemoryTokenStore())
.authenticationManager(authenticationManager);
}
}
}
如何正确配置资源服务器？
更新：
我使用 Spring Boot 1.5.10、spring-security-oauth2 2.0.14 和 Spring Boot 2.0.0、spring-security-oauth2 2.3.0 测试了以下配置。
使用 1.5.10 它可以正常工作，但使用 2.0.0 我得到 “出现意外错误（类型=不允许方法，状态=405）。”处理登录。我看到安全过滤器链中缺少 UsernamePasswordAuthenticationFilter。
我错过了 Spring Boot 2.0.0 或 Spring Security 5.0.3 的重大变化吗？
@Configuration
@EnableWebMvc
@EnableAuthorizationServer
@EnableResourceServer
@EnableWebSecurity(debug = true)
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
public class SecurityConfiguration {
@Configuration
protected static class WebMvcConfiguration extends WebMvcConfigurerAdapter implements WebMvcConfigurer {
@Override
public void addViewControllers(final ViewControllerRegistry registry) {
registry.addViewController("/login").setViewName("login");
registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
}
}
@Configuration
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
private static final String RESOURCE_ID = "Sample";
@Override
public void configure(final ResourceServerSecurityConfigurer resources) throws Exception {
resources.resourceId(RESOURCE_ID);
}
@Override
public void configure(final HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/sample**").authenticated()
;
}
}
@Configuration
protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
@Autowired
private AuthenticationManager authenticationManager;
@Override
public void configure(final AuthorizationServerSecurityConfigurer security) throws Exception {
security
.tokenKeyAccess("permitAll()")
.checkTokenAccess("isAuthenticated()")
;
}
@Override
public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {
clients
.inMemory()
.withClient("ABC")
.secret("{noop}sec1")
.autoApprove(true)
.authorizedGrantTypes("authorization_code", "client_credentials", "password", "refresh_token")
.scopes("read", "write")
.redirectUris("http://google.com")
;
}
@Override
public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints
.tokenStore(new InMemoryTokenStore())
.authenticationManager(authenticationManager);
}
}
@Configuration
protected static class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
auth
.inMemoryAuthentication()
.withUser("john")
.password("{noop}123")
.roles("User");
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Override
protected void configure(final HttpSecurity http) throws Exception {
http
.requestMatchers()
.antMatchers("/ping")
.antMatchers("/login")
.antMatchers("/oauth/**")
.and()
.authorizeRequests()
.antMatchers("/ping").permitAll()
.anyRequest().authenticated()
.and()
.csrf()
.and()
.formLogin()
.usernameParameter("username")
.passwordParameter("password")
.loginPage("/login")
.permitAll()
.and()
.rememberMe()
.rememberMeParameter("remember")
.and()
.httpBasic().disable()
.logout().permitAll();
}
}
}
【问题讨论】：
标签： spring-boot spring-security-oauth2