Spring OAuth2授权：拒绝访问

Question

我对spring security&oauth2相当陌生。作为学习的一部分，我试图设置一个OAuth2授权服务器，并保护RESTendpoint免受未经授权的访问。

/products : only user with Authority='ROLE_PRODUCT_USER' and scope='read' can access this endpoint
/addProduct :  only user with Authority='ROLE_PRODUCT_ADMIN' and scope='write' can access this endpoint

代码

资源服务器

ProductController.java

@RestController
public class ProductController {

    @Autowired
    private ProductService productService;

    @PreAuthorize("#oauth2.hasScope('read') and hasAuthority('ROLE_PRODUCT_USER')")
    @GetMapping("/products")
    public ResponseEntity<List<Product>> getAllProducts() {
        return new ResponseEntity<List<Product>>(productService.getAllProducts(), HttpStatus.OK);
    }

    @PreAuthorize("#oauth2.hasScope('write') and hasAuthority('ROLE_PRODUCT_ADMIN')")
    @PostMapping("/addproduct")
    public ResponseEntity<Product> addProduct(@RequestBody Product product) {
        return new ResponseEntity<Product>(productService.addProduct(product), HttpStatus.OK);
    }



}

security:
  oauth2:
    resource:
      user-info-uri: http://localhost:9090/user

import java.security.Principal;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

    @SpringBootApplication
    @EnableAuthorizationServer
    @EnableResourceServer
    @RestController
    public class OAuthAuthorizationServerApplication {

        public static void main(String[] args) {
            SpringApplication.run(OAuthAuthorizationServerApplication.class, args);
        }

        @GetMapping("/user")
        public Principal user(Principal user) {
            System.out.println(user);
            return user;
        }

    }

+-----------+--------------+----------------------------------------------------------------------+------------+--------------------------------------------------------------+----------------------------+--------------------+-----------------------+------------------------+------------------------+-------------+
| client_id | resource_ids | client_secret                                                        | scope      | authorized_grant_types                                       | web_server_redirect_uri    | authorities        | access_token_validity | refresh_token_validity | additional_information | autoapprove |
+-----------+--------------+----------------------------------------------------------------------+------------+--------------------------------------------------------------+----------------------------+--------------------+-----------------------+------------------------+------------------------+-------------+
| reader    | product_api  | {bcrypt}removed | read       | client_credentials,password,refersh_token,authorization_code | http://localhost:8080/home | ROLE_PRODUCT_USER  |                 10800 |                2592000 | NULL                   | NULL        |
| writer    | product_api  | {bcrypt}removed | read,write | client_credentials,password,refersh_token,authorization_code | http://localhost:8080/home | ROLE_PRODUCT_ADMIN |                 10800 |                2592000 | NULL                   | NULL        |
+-----------+--------------+----------------------------------------------------------------------+------------+--------------------------------------------------------------+----------------------------+--------------------+-----------------------+------------------------+------------------------+-------------+

1. 未经授权API可以正常工作
2. 如果我们只使用权限(@preauthorize(“hasauthorize('...')”））进行授权，它可以正常工作
3. 作用域在到达oauth2ExpressionUtils-->hasAnyScope()时在authiEntication.oauth2Request中丢失（空列表）。
4. 作用域由授权服务器的/userendpoint提供

{authorities=[{id=4,authority=role_product_user}],details={remoteaddress=127.0.0.1,sessionid=null,tokenvalue=2f54e499-e47a-45fe-a6f6-e4c9593f9841,tokentype=bearer,decodeddetails=null},authenticated=true,userauthentication={authorities=[{id=4,authority=role_product_user}],details={ULL,username=product_user,authorities=[{id=4,authority=role_product_user}],accountnonexpired=true,accountnonlocked=true,credentialsnonexpired=true,credenabled=true},credentials=true,credentials=null,name=product_user},credentials=true,credentials=oauth2request={clientid=reader,scope=[read],=null,responseTypes=[],extensions={},granttype=password,refreshtokenrequest=null},principal={password=null,username=product_user,authorities=[{id=4,authority=role_product_user}],accountnonexpired=true,accountnonlocked=true,credentialsnonexpired=true,enabled=true},clientonly=false,name=product_user}

但是在UserInfotokenServices.ExtractauthEntication（）中创建OAuth2Request时，它不会持久化

private OAuth2Authentication extractAuthentication(Map<String, Object> map) {
Object principal = getPrincipal(map);
List<GrantedAuthority> authorities = this.authoritiesExtractor
        .extractAuthorities(map);
OAuth2Request request = new OAuth2Request(null, this.clientId, null, true, null,
        null, null, null, null);
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
        principal, "N/A", authorities);
token.setDetails(map);
return new OAuth2Authentication(request, token);    }

这里的第5个paramter是一组表示作用域的字符串，它作为null传递！

OAuth2Request request=new OAuth2Request（null,this.clientid,null,true,null,null,null,null,null,null,null）；

Answer 1

正如您已经注意到并在问题#5096中提到的，默认的UserInfotokenServices不支持作用域，因此#oauth2.hasscope功能。一个可能的解决方案是实现自定义ResourceServerTokenServices。

我还想提请您注意这样一个事实：Spring Security OAuth项目是不推荐的，不建议使用。