OAuth2 与 Spring REST API 的集成

Question

我的代码中很少有Spring REST API是用基本TLS保护的。但是，我正在尝试使用 OAuth2.0 Spring安全性保护我的 API（我之前没有这样做过）。我无法选择使用Facebook或Google OAuth API进行身份验证/授权部分，因此我创建了自己的API，它将作为REST API所在的应用程序的一部分托管。我按照此处的示例将以下配置设置作为 OAuth 的一部分......

https://techannotation.wordpress.com/2014/04/29/5-minutes-with-spring-oauth-2-0/ http://www.beingjavaguys.com/2014/10/spring-security-oauth2-integration.html

<http pattern="/oauth/token" create-session="stateless"
    authentication-manager-ref="authenticationManager"
    xmlns="http://www.springframework.org/schema/security">
    <intercept-url pattern="/oauth/token" method="GET" access="IS_AUTHENTICATED_FULLY" />
    <anonymous enabled="false" />
    <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
    <custom-filter ref="clientCredentialsTokenEndpointFilter"
        after="BASIC_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<http pattern="/generatePDF" create-session="never"
    entry-point-ref="oauthAuthenticationEntryPoint"
    access-decision-manager-ref="accessDecisionManager" use-expressions="true"
    xmlns="http://www.springframework.org/schema/security">
    <anonymous enabled="false" />
    <intercept-url pattern="/generatePDF" method="POST" access="IS_AUTHENTICATED_FULLY" />
    <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<bean id="oauthAuthenticationEntryPoint"
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
</bean>

<bean id="clientAuthenticationEntryPoint"
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <property name="realmName" value="security/client" />
    <property name="typeName" value="Basic" />
</bean>

<bean id="oauthAccessDeniedHandler"
    class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />

<bean id="clientCredentialsTokenEndpointFilter"
    class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <property name="authenticationManager" ref="authenticationManager" />
</bean>

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
    xmlns="http://www.springframework.org/schema/beans">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
            <bean class="org.springframework.security.web.access.expression.WebExpressionVoter" />
        </list>
    </constructor-arg>
</bean>
<authentication-manager alias="authenticationManager"
    xmlns="http://www.springframework.org/schema/security">
    <authentication-provider>
        <user-service id="userDetailsService">
            <user name="hcacl" password="pdf4hcacl" authorities="ROLE_CLIENT" />
        </user-service>
    </authentication-provider>
</authentication-manager>
<bean id="tokenStore"
    class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore" />

<bean id="tokenServices"
    class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <property name="tokenStore" ref="tokenStore" />
    <property name="supportRefreshToken" value="true" />
    <property name="clientDetailsService" ref="clientDetails" />
</bean>

<bean id="userApprovalHandler"
    class="org.springframework.security.oauth2.provider.approval.DefaultUserApprovalHandler">
</bean>

<oauth:authorization-server
    client-details-service-ref="clientDetails" token-services-ref="tokenServices"
    user-approval-handler-ref="userApprovalHandler">
    <oauth:authorization-code />
    <oauth:implicit />
    <oauth:refresh-token />
    <oauth:client-credentials />
    <oauth:password authentication-manager-ref="clientAuthenticationManager"/>
</oauth:authorization-server>

<oauth:resource-server id="resourceServerFilter"
    resource-id="test" token-services-ref="tokenServices" />

<oauth:client-details-service id="clientDetails">
    <!-- Add for each client -->
    <oauth:client client-id="hcacl"
                  authorized-grant-types="password,authorization_code,refresh_token,implicit,,client_credentials"
                  secret="1234567890" authorities="ROLE_CLIENT" scope="read,write,trust" />
</oauth:client-details-service>

<oauth:expression-handler id="oauthExpressionHandler" />

<oauth:web-expression-handler id="oauthWebExpressionHandler" />

然而，当我试图通过设置Oauth参数从soapUI测试受保护的资源时，我总是遇到如下的身份验证错误。。。

[2/26/16 9:37:11:472 EST] 000000b4 webapp        E com.ibm.ws.webcontainer.webapp.WebApp logServletError SRVE0293E: [Servlet Error]-[documentService]: org.springframework.security.authentication.InsufficientAuthenticationException: User must be authenticated with Spring Security before authorization can be completed.
    at org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(AuthorizationEndpoint.java:138)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:88)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
    at java.lang.reflect.Method.invoke(Method.java:613)
    at org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:215)

在这一点上，我对我需要在哪里进行修复感到困惑。是soapUI中的某种设置，还是代码中OAuth设置的调整？

非常感谢任何解决此问题的指示！

Answer 1

毕竟，我发现我的配置是正确的并且可以工作，但是我不知道如何从soapUI测试我的API。soapUI有一个在资源上使用OAuth认证的选项，但是我不能正确地设置它。相反，我在我的soapUI项目中创建了另一个/oauth/token资源，并取回了令牌。