在春季，基于 oauth 令牌和基于会话的授权如何协同工作？答案

【问题标题】：how oauth token based and session based authorization works together in spring?在春季，基于 oauth 令牌和基于会话的授权如何协同工作？
【发布时间】：2017-07-25 19:50:20
【问题描述】：

我试图将具有客户端凭据授予类型的基于 oauth2 的令牌与基于 Spring 会话的身份验证集成。它与 oauth 令牌和给定的权限一起工作正常。

当我将它们结合起来时它不起作用。它总是调用 UsernamePasswordAuthenticationFilter 而不是 OAuth2AuthenticationProcessingFilter

如何让它们一起工作？这是我的 ResourceServer 配置

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId(SPARKLR_RESOURCE_ID).stateless(false);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http
            // Since we want the protected resources to be accessible in the UI as well we need 
            // session creation to be allowed (it's disabled by default in 2.0.6)
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
        .and()
            .requestMatchers().antMatchers("/api/account/**", "/oauth/users/**", "/oauth/clients/**","/me")
        .and()
            .authorizeRequests()
                .antMatchers("/api/account/**").access("#oauth2.hasScope('read') or (!#oauth2.isOAuth() and hasRole('ROLE_USER'))")                 
                .regexMatchers(HttpMethod.DELETE, "/oauth/users/([^/].*?)/tokens/.*")
                    .access("#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('write')")
                .regexMatchers(HttpMethod.GET, "/oauth/clients/([^/].*?)/users/.*")
                    .access("#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('read')")
                .regexMatchers(HttpMethod.GET, "/oauth/clients/.*")
                    .access("#oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.isClient() and #oauth2.hasScope('read')");
        // @formatter:on
    }
}

问题是，在过滤器链中 OAuth2AuthenticationProcessingFilter 没有被调用。因此，任何休息呼叫都不会发生令牌验证。下面是过滤器链。

XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 1 of 12 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 2 of 12 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
XNIO-2 task-1] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists
XNIO-2 task-1] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created.
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 3 of 12 in additional filter chain; firing Filter: 'HeaderWriterFilter'
XNIO-2 task-1] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@74d294b6
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 4 of 12 in additional filter chain; firing Filter: 'LogoutFilter'
XNIO-2 task-1] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/api/logout', GET]
XNIO-2 task-1] o.s.s.web.util.matcher.OrRequestMatcher  : No matches found
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 5 of 12 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
XNIO-2 task-1] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /api/account' doesn't match 'POST /api/authentication
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 6 of 12 in additional filter chain; firing Filter: 'DefaultLoginPageGeneratingFilter'
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 7 of 12 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 8 of 12 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 9 of 12 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
XNIO-2 task-1] o.s.s.w.a.AnonymousAuthenticationFilter  : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 10 of 12 in additional filter chain; firing Filter: 'SessionManagementFilter'
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 11 of 12 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
XNIO-2 task-1] o.s.security.web.FilterChainProxy        : /api/account at position 12 of 12 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'

编辑：我正在尝试将这两个项目合并在一起。 https://github.com/jhipster/jhipster-sample-app 和 https://github.com/spring-projects/spring-security-oauth/tree/master/samples/oauth2/sparklr

【问题讨论】：

您没有显示主过滤器链是如何配置的（您似乎已经通过此请求进入了这一点）。某处有完整的样本吗？
@Dave - 请找到完整的示例 -(github.com/ibagui/besquare-oauth/blob/master/src/main/java/io/…)。我正在尝试将这两个项目合并在一起。 (github.com/jhipster/jhipster-sample-app) 和 (github.com/spring-projects/spring-security-oauth/tree/master/…)

标签： spring-security oauth-2.0 spring-security-oauth2

【解决方案1】：

您使用的是 spring boot 1.5，因此默认情况下您的资源服务器过滤器链具有比 jhipster 添加的自定义过滤器链更高的顺序。要么您需要更改订单，要么更改模式匹配器，以便主过滤器链不匹配 OAuth 资源。 Spring Boot 用户指南建议您按特定顺序放入自定义过滤器链 (SecurityProperties.ACCESS_OVERRIDE_ORDER)。听从这个建议可能是个好主意。

【讨论】：