如何要求 Spring OAuth 端点的 x509 身份验证

Question

我正在使用 Spring 4.0 java 配置。

我想在我的 oauth 端点上要求 x509 身份验证，但对于所有其他资源端点只需要一个 oauth 令牌。第一个antMatchers 似乎被覆盖了：

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

  @Autowired
  RequestMappingUriProvider requestMappingUriProvider;

  @Autowired
  private DelegatedUserManager userManager;

  @Override
  public void configure(ResourceServerSecurityConfigurer resources) {
    // @formatter:off
    resources.resourceId(RESOURCE_ID);
    // @formatter:on
  }

  @Override
  public void configure(HttpSecurity http) throws Exception {
    // @formatter:off
    // Require x509 certificate for obtaining OAuth credentials
    http.requestMatchers().antMatchers("/oauth/**")
        .and()
        .authorizeRequests().anyRequest().hasAnyRole("USER","CLIENT")
        .and()
        .x509().subjectPrincipalRegex("CN=(.*?),").authenticationUserDetailsService(authenticationUserDetailsService())
        .and()
        //Only require a user role for interaction with all other resources
        .requestMatchers().antMatchers(requestMappingUriProvider.uriPatterns())
        .and()
        .authorizeRequests().anyRequest().hasRole("USER");
    // @formatter:on
  }

  @Bean
  public DelegatedAuthenticationUserDetailsService authenticationUserDetailsService() {
    return new DelegatedAuthenticationUserDetailsService(userManager);
  }

}

spring 的调试输出未显示我在 x509 过滤器链中检查的任何 /oauth/** 端点。

Answer 1

我的问题是我需要多个 HttpSecurity 元素。这篇文章帮助了我：Creating multiple HTTP sections in Spring Security Java Config

我是这样实现的：

  @Configuration
  @EnableResourceServer
  public static class ResourceServerConfiguration {

    @Configuration
    @Order(1)
    public static class OAuthResourceServerConfigAdapter extends ResourceServerConfigurerAdapter {
      @Autowired
      private DelegatedUserManager userManager;

      @Override
      public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId(RESOURCE_ID);
      }

      @Override
      public void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        // Require x509 certificate for obtaining OAuth credentials
        http.requestMatchers().antMatchers("/oauth/**")
            .and()
            .authorizeRequests().anyRequest().hasAnyRole("USER","CLIENT")
            .and()
            .x509().subjectPrincipalRegex("CN=(.*?),").authenticationUserDetailsService(authenticationUserDetailsService());
        // @formatter:on
      }

      @Bean
      public DelegatedAuthenticationUserDetailsService authenticationUserDetailsService() {
        return new DelegatedAuthenticationUserDetailsService(userManager);
      }

    }

    public static class MyResourceServerConfigAdapter extends ResourceServerConfigurerAdapter {
      @Autowired
      RequestMappingUriProvider requestMappingUriProvider;

      @Override
      public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId(RESOURCE_ID);
      }

      @Override
      public void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        //Only require a user role for interaction with all other resources
        http.requestMatchers().antMatchers(requestMappingUriProvider.uriPatterns())
            .and()
            .authorizeRequests().anyRequest().hasRole("USER");
        // @formatter:on
      }

    }
  }