在自定义登录页面中输入用户名和密码时，出现Spring Oauth2错误“在请求参数中未找到令牌”

Question

我已经在spring boot和spring-security-oauth2中创建了自定义登录页面。输入用户名和密码时，出现如下错误

o. s. s. o. p. a. BearerTokenExtractor：在标头中找不到令牌。正在尝试请求参数。o. s. s. o. p. a. BearerTokenExtractor：在请求参数中找不到令牌。不是一个OAuth2请求。p.a.OAuth2Auth

如何传递令牌作为标头参数任何线索？

 @Configuration
    @EnableWebSecurity
    @Import(Encoders.class)
    public class ServerSecurityConfig extends WebSecurityConfigurerAdapter {

        @Autowired
        private UserDetailsService userDetailsService;

        @Autowired
        private PasswordEncoder userPasswordEncoder;

        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(userDetailsService).passwordEncoder(userPasswordEncoder);
        }

        @Override
        @Order(Ordered.HIGHEST_PRECEDENCE)
        protected void configure(HttpSecurity http) throws Exception {
            http
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .csrf().disable()
            .authorizeRequests()
            .antMatchers("/resources/**").permitAll()
            .antMatchers("/about").permitAll() 
            .antMatchers("/oauth/token").permitAll()
            .and()
            .httpBasic()
            .and()
            .formLogin()
            .loginPage("/login")
            .loginProcessingUrl("/loginSecure")
            .defaultSuccessUrl("/index", true)
            .permitAll();
            }
}

和资源服务器

    @Configuration
    @EnableResourceServer
    public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

        private static final String RESOURCE_ID = "resource-server-rest-api";
        private static final String SECURED_READ_SCOPE = "#oauth2.hasScope('read')";
        private static final String SECURED_WRITE_SCOPE = "#oauth2.hasScope('write')";
        private static final String SECURED_PATTERN = "/secured/**";

        @Override
        public void configure(ResourceServerSecurityConfigurer resources) {
            resources.resourceId(RESOURCE_ID);
        }

        @Override
        @Order(Ordered.HIGHEST_PRECEDENCE)
        public void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests().antMatchers("/login", "/resources/**/**","/resources/").permitAll()
            .and().requestMatchers()
                    .antMatchers("/loginSecure", SECURED_PATTERN).and().authorizeRequests()
                    .antMatchers("/loginSecure", SECURED_PATTERN).access(SECURED_WRITE_SCOPE)
                    .anyRequest().access(SECURED_READ_SCOPE)
                    .and().csrf().disable();

        }
}

AuthorizationServerConfigurerAdapter类：

@Configuration
@EnableAuthorizationServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
@Import(ServerSecurityConfig.class)
public class AuthServerOAuth2Config extends AuthorizationServerConfigurerAdapter {
    @Autowired
    @Qualifier("dataSource")
    private DataSource dataSource;

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private PasswordEncoder oauthClientPasswordEncoder;

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }

    @Bean
    public OAuth2AccessDeniedHandler oauthAccessDeniedHandler() {
        return new OAuth2AccessDeniedHandler();
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) {
        oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()").passwordEncoder(oauthClientPasswordEncoder);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.jdbc(dataSource);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
        endpoints.tokenStore(tokenStore()).authenticationManager(authenticationManager).userDetailsService(userDetailsService);
    }
}

Answer 1

在更改高于资源服务器的网络安全配置器适配器的顺序后，我已经解决了这个问题。这是因为资源服务器的过滤器链排名高于 WebSecurityConfigurerAdapter 配置的过滤器链。

参考链接：同一资源的带有Oaust2或Http-Basic身份验证的Spring Security性