具有自定义 AuthenticationProvder 的 Spring Security 授权服务器答案

【问题标题】：Spring Security Authorization Server with custom AuthenticationProvder具有自定义 AuthenticationProvder 的 Spring Security 授权服务器
【发布时间】：2021-03-13 11:29:24
【问题描述】：

我在 Spring 中配置 Oauth2 身份验证服务器时遇到问题，我有我的自定义 AuthenticationProvider 并且我正在定义我自己的 AuthenticationManager，但每次我向“/oauth/token”请求令牌时，我看到Spring一直在Spring定义的ProviderManager中注入和调用默认的DaoAuthenticationProvider。

这是我的配置类：

@Configuration
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

    private AuthenticationManager authenticationManager;

    public AuthorizationServerConfiguration(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
    }

    @Bean
    PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }

    @Bean
    JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        return converter;
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager);
    }

}

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    private AuthenticationProvider authenticationProvider;

    public WebSecurityConfig(AuthenticationProvider authenticationProvider) {
        this.authenticationProvider = authenticationProvider;
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return new ProviderManager(authenticationProvider);
    }
}

提前致谢

编辑

@Service
public class CustomAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {

    private ADCustomerService adCustomerService;

    public CustomAuthenticationProvider(ADCustomerService adCustomerService) {
        this.adCustomerService = adCustomerService;
    }

    @Override
    protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {

    }

    @Override
    protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        return adCustomerService.retrieveUser(username, authentication);
    }
}

【问题讨论】：

您的自定义身份验证提供程序在哪里？
@silentsudo 它在我的项目中，并带有“@Service”注释
@silentsudo 刚刚在原始帖子中添加了课程
我试图帮助你提出一个建议，但我会推荐使用keycloak.org

标签： java spring oauth-2.0 authorization

【解决方案1】：

您需要从 WebSecurityConfigurerAdapter 类覆盖 configure(AuthenticationManagerBuilder auth)

最后的类应该是这样的

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthenticationProvider authenticationProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider);
    }
    
}

【讨论】：

感谢您的建议，我试过了，但还是一样，仍然看到 DaoAuthenticationProvider 而不是我的提供者

【解决方案2】：

如下编辑您的 WebSecurityConfig：

来自

  @EnableWebSecurity
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
        private AuthenticationProvider authenticationProvider;
    
        public WebSecurityConfig(AuthenticationProvider authenticationProvider) {
            this.authenticationProvider = authenticationProvider;
        }
    
        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return new ProviderManager(authenticationProvider);
        }
    }

到

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    private CustomAuthenticationProvider customAuthenticationProvider;

    public WebSecurityConfig(AuthenticationProvider authenticationProvider) {
        this.authenticationProvider = authenticationProvider;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider);
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return new ProviderManager(authenticationProvider);
    }
}

【讨论】：