如何在 Spring Boot 中使用授权服务器端点获取 oauth 令牌

Question

朋友们，我正在开发自己的 oauth2 服务器，具有资源服务器和授权服务器配置，我已经部分完成了自己的 oauth2 服务器，但无法使用令牌端点 http://localhost:8080/oauth/token 获取 oauth 令牌。

OAuthConfig：

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JdbcTokenStore;


@Configuration
public class OAuth2Config {

    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

        @Override
        public void configure(final HttpSecurity http) throws Exception {
            http.authorizeRequests().antMatchers("/login").permitAll().and()
                    .authorizeRequests().anyRequest().authenticated();
        }
    }

    @Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private AuthenticationManager authenticationManager;    

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
                            endpoints.authenticationManager(authenticationManager);
        }

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()
                    .withClient("acme")
                    .secret("acmesecret")
                    .authorizedGrantTypes("authorization_code", "refresh_token",
                            "password").scopes("openid");
        }
    }
}

SpringSecurityConfig：

import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

/**
 * Created by qasim on 12/3/16.
 */
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
@Order(-10)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {




    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests().antMatchers("/oauth/authorize").authenticated().and()
                .authorizeRequests().anyRequest().permitAll().and().httpBasic().and()
        .authorizeRequests().antMatchers("/oauth/confirm_access").authenticated();
    }


}

在OauthConfig 类中，我使用inmemory 来存储客户详细信息。

此时我的资源服务器中没有任何东西，尽管我现在没有 nedd。我只想创建我确信它将通过Authorization 服务器生成的令牌。

现在当我打开这个 url 'http://localhost:8080/oauth/authorize?response_type=code&client_id=acme&redirect_uri=http://localhost:8080/fd/redirectauthorization' 时，我看到了这个屏幕。

提供凭据后

这是我的自定义 oauth 屏幕，我没有使用默认的 oauth 批准屏幕 我的 OAuth 控制器是

@Controller
@RequestMapping("/oauth")
public class OauthController {

    @Autowired
    ClientDetailsService clientDetailsService;

    @RequestMapping("/confirm_access")
    public String confirmAccess(HttpServletRequest httpServletRequest, HttpSession httpSession){            
        // logic
        return "oauthAccess";
    }

}

On Approval Controller 将我带到带有一些 code 值的重定向 url

重定向代码

@Controller
@RequestMapping("/fd")
public class RedirectController {

    @RequestMapping("/redirectauthorization")
    public String redirectauthorization(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, ModelMap modelMap, HttpSession httpSession){

        return "authorizationcode";
    }
}

现在我使用此代码在 url 中附加了代码，我尝试使用 curl 命令获取令牌，但出现 Bad Credential 错误或未经授权的错误（401），如下图所示

curl acme:acmesecret@localhost:8080/oauth/token -d 'grant_type=authorization_code&code=WeIYSm'

谁能指导我生成oauth令牌

Answer 1

你的 curl 应该看起来更像这样：

curl acme:acmesecret@localhost:8080/oauth/token -d