Grails 3-Spring SecurityOAuth2提供程序-自定义安全提供程序被忽略

Question

我的配置是：

< li>Grails框架3.0.11 < Li > " org . grails . plugins:spring-security-core:3 . 0 . 3 " < Li > " org . grails . plugins:spring-security-oauth 2-provider:3 . 0 . 0-RC1 "

我已经指定了我的自定义用户详细信息服务（实现GrailsUserDemailsService）、自定义用户详细信息类（扩展Grailsuser）和自定义安全身份验证提供程序（扩展AbstractUserDemailsAuth

我将它放在resources.groovy中，如下所示:

userDetailsService(My2nUserDetailsService)

my2nAuthenticationProvider(My2nAuthenticationProvider) {
    userDetailsService = ref('userDetailsService')
}

现在我的问题是，当我想将 POST 发送到 /oauth/token 时，我的自定义提供程序 （my2nAuthenticationProvider） 被忽略并使用默认的 daoAuthenticationProvider，并且它失败了，因为该提供程序调用默认的用户详细信息服务（所以再次...我的自定义My2nUserDetailsService被忽略），一切都失败了。

我是这样配置Spring Security core和Spring Security Oauth2 provider的:

// Added by the Spring Security Core plugin:
grails.plugin.springsecurity.userLookup.userDomainClassName = 'cz.quanti.my2n.domains.my2n.My2nUser'
grails.plugin.springsecurity.userLookup.authorityJoinClassName = 'cz.quanti.my2n.domains.my2n.My2nUserRole'
grails.plugin.springsecurity.authority.className = 'cz.quanti.my2n.domains.my2n.My2nRole'
grails.plugin.springsecurity.rejectIfNoRule = false
grails.plugin.springsecurity.fii.rejectPublicInvocations = true
grails.plugin.springsecurity.securityConfigType = 'InterceptUrlMap'
grails.plugin.springsecurity.logout.postOnly = false
grails.plugin.springsecurity.password.algorithm = 'SHA-256'
grails.plugin.springsecurity.password.hash.iterations = 1
grails.plugin.springsecurity.providerNames = [
        'my2nAuthenticationProvider'
]
grails.plugin.springsecurity.controllerAnnotations.staticRules = [
    [pattern: '/oauth/authorize.dispatch', access: "IS_AUTHENTICATED_ANONYMOUSLY"],
    [pattern: '/oauth/token.dispatch', access: "IS_AUTHENTICATED_ANONYMOUSLY"]
]

// https://grails-plugins.github.io/grails-spring-security-core/v2/guide/filters.html
grails.plugin.springsecurity.filterChain.chainMap = [
            [pattern: '/oauth/token', filters: 'JOINED_FILTERS,-oauth2ProviderFilter,-clientCredentialsTokenEndpointFilter,-securityContextPersistenceFilter,-logoutFilter,-authenticationProcessingFilter,-rememberMeAuthenticationFilter,-exceptionTranslationFilter'],
            [pattern: '/oauth/authorize', filters: 'JOINED_FILTERS,-oauth2ProviderFilter,-clientCredentialsTokenEndpointFilter,-securityContextPersistenceFilter,-logoutFilter,-authenticationProcessingFilter,-rememberMeAuthenticationFilter,-exceptionTranslationFilter'],
            ...
            [pattern: '/**', filters: 'JOINED_FILTERS,-statelessSecurityContextPersistenceFilter,-oauth2ProviderFilter,-clientCredentialsTokenEndpointFilter,-oauth2BasicAuthenticationFilter,-oauth2ExceptionTranslationFilter,-restTokenValidationFilter,-restExceptionTranslationFilter']   // Traditional chain
    ]

// Added by the Spring Security OAuth2 Provider plugin:
grails.plugin.springsecurity.oauthProvider.clientLookup.className = 'cz.quanti.my2n.domains.hipmo.OauthClient'
grails.plugin.springsecurity.oauthProvider.authorizationCodeLookup.className = 'cz.quanti.my2n.domains.hipmo.OauthAuthorizationCode'
grails.plugin.springsecurity.oauthProvider.accessTokenLookup.className = 'cz.quanti.my2n.domains.hipmo.OauthAccessToken'
grails.plugin.springsecurity.oauthProvider.refreshTokenLookup.className = 'cz.quanti.my2n.domains.hipmo.OauthRefreshToken'
grails.plugin.springsecurity.oauthProvider.authorization.requireScope = false

你能给我一些建议吗？

Answer 1

您将 securityConfigType 声明为 “InterceptUrlMap”，但您使用 controllerAnnotations 进行映射。更新 securityConfigType 以使用“注释”

Answer 2

我还没有使用过这个插件，但如果您希望您的bean注册替换插件注册的bean，则需要在resources.groovy中使用相同的bean名称。从插件源代码来看，我假设您希望替换＜code＞clientCredentialsAuthenticationProvider＜/code＞bean，因此您的提供者注册应该如下

clientCredentialsAuthenticationProvider(My2nAuthenticationProvider) {
   userDetailsService = ref('userDetailsService')

}