使用 spring-security-oauth2 的“访问被拒绝（用户不是匿名的）”

Question

我是 Spring Security 和 Oauth 的新手，我正在尝试设置一个简单的示例来保护使用 Oauth2 访问路径“/api”中的资源。我正在使用 spring-security-oauth2-1.0.0.RC2。经过一段时间的配置处理，我能够获得令牌，但是当我尝试向“/api”资源发送请求时，我面临两个问题：

• 最初，我发送带有“OAuth2”前缀的授权标头，但 spring-security-oauth2 似乎需要令牌中带有“Bearer”前缀的标头才能找到它们。这些令牌有什么区别？

• 在 Spring 验证令牌后，我收到一个安全错误：“ExceptionTranslationFilter - 访问被拒绝（用户不是匿名的）”，我遇到了这个问题。由于我使用的是 InMemory 令牌存储，我每次都必须登录才能授权客户端，然后我收到此错误。这是spring的配置：

<http pattern="/api/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
    access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security">
    <anonymous enabled="false" />
    <intercept-url pattern="/api/**" access="ROLE_CLIENT,SCOPE_READ" />
    <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>

<http disable-url-rewriting="true" xmlns="http://www.springframework.org/schema/security">
    <intercept-url pattern="/oauth/**" access="ROLE_USER" />
    <!--intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /-->
    <form-login/>
    <logout logout-success-url="/index.jsp" logout-url="/logout" />
</http>

<bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <property name="realmName" value="O2Server" />
</bean>

<bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />

<bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <property name="authenticationManager" ref="clientAuthenticationManager" />
</bean>

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" xmlns="http://www.springframework.org/schema/beans">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
            <bean class="org.springframework.security.access.vote.RoleVoter" />
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
        </list>
    </constructor-arg>
</bean>

<authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>

<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
    <authentication-provider>
        <user-service>
            <user name="test" password="test" authorities="ROLE_USER" />
        </user-service>
    </authentication-provider>
</authentication-manager>

<bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
    <constructor-arg ref="clientDetails" />
</bean>

<bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" />

<bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <property name="tokenStore" ref="tokenStore" />
    <property name="supportRefreshToken" value="true" />
    <property name="clientDetailsService" ref="clientDetails"/>
</bean>

<bean id="userApprovalHandler" class="org.o2server.security.O2ServerUserApprovalHandler">
    <property name="tokenServices" ref="tokenServices" />
</bean>

<oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices" user-approval-handler-ref="userApprovalHandler">
    <oauth:authorization-code />
    <oauth:implicit />
    <oauth:refresh-token />
    <oauth:client-credentials />
    <oauth:password />
</oauth:authorization-server>

<oauth:resource-server id="resourceServerFilter" resource-id="O2Server" token-services-ref="tokenServices" />

<oauth:client-details-service id="clientDetails">
    <oauth:client client-id="O2Client" resource-ids="O2Server" authorized-grant-types="authorization_code,refresh_token,implicit"
        authorities="ROLE_CLIENT" scope="read,write" secret="secret" />
</oauth:client-details-service>

<oauth:web-expression-handler id="oauthWebExpressionHandler" />

这是来自服务器的日志：

11:58:30.366 [DEBUG] FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /api/user/; Attributes: [ROLE_CLIENT, SCOPE_READ]
11:58:30.366 [DEBUG] FilterSecurityInterceptor - Previously Authenticated: org.springframework.security.oauth2.provider.OAuth2Authentication@48a94464: Principal: org.springframework.security.core.userdetails.User@346448: Username: paul; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetails@43794494; Granted Authorities: ROLE_USER
11:58:30.366 [DEBUG] UnanimousBased - Voter: org.springframework.security.oauth2.provider.vote.ScopeVoter@4e857327, returned: 0
11:58:30.366 [DEBUG] UnanimousBased - Voter: org.springframework.security.access.vote.RoleVoter@1b4b2db7, returned: -1
11:58:30.367 [DEBUG] ExceptionTranslationFilter - Access is denied (user is not anonymous); delegating to AccessDeniedHandler <org.springframework.security.access.AccessDeniedException: Access is denied>org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.UnanimousBased.decide(UnanimousBased.java:90)

拜托，你能给我一些建议吗？

提前谢谢你。

Answer 1

正如 Xaerxess 所说，您应该将拦截 URL 访问属性更改为 ROLE_USER。

<intercept-url pattern="/api/**" access="ROLE_CLIENT,SCOPE_READ" />

到

<intercept-url pattern="/api/**" access="ROLE_USER,SCOPE_READ" />

访问属性控制用户的角色（客户端代表该角色）。

标签<oauth:client> 的authorities (ROLE_CLIENT) 属性的文档说明：

授予客户端的权限（逗号分隔）。清楚的 从授予客户代表的用户的权限 正在演戏。

另外，根据用户 Dave Syer 的说法：

如果你没有改变 Tonr，它不是在充当客户，它是在充当 代表用户（没有所需的 ROLE_CLIENT），所以 预计你会得到一个 403。如果你想做一个 关于来自 tonr 的请求来自客户端的断言 特定角色（无需更改应用程序）您可以使用表达式， 例如“oauthClientHasRole('ROLE_CLIENT') 和 hasScope('trust')”。

来源： http://forum.springsource.org/showthread.php?125468-confusing-between-ROLE_USER-ROLE_CLIENT

Answer 2

我从未使用过 oauth 插件，但从阅读调试输出中我可以说 RoleVoter 返回 -1，这意味着访问被 DecisionVoter 拒绝。我看到您只向尝试访问 url /api/user/ 的委托人授予了 ROLE_USER，而这由 [ROLE_CLIENT, SCOPE_READ] 保护，这就是访问被拒绝的原因。

要么将 ROLE_CLIENT 和 SCOPE_READ 授予委托人，要么更改 <intercept-url pattern="/api/**" access="ROLE_CLIENT,SCOPE_READ" />。