spring安全-如何在Hybris中使用基本HTTP身份验证访问v2 API？

Question

我想使用基本身份验证（用户名/密码）访问v2API，我已经做了下面提到的所有更改。但当我点击web服务URL时，我会弹出一个用于提供用户名/密码的窗口，而该窗口并不接受（验证）我的用户名/密码。我确信我输入了正确的用户名和密码。

web.xml：

<security-role>
<description>
The role that is required to access the application
</description>
<role-name>admin</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>RestrictedWebResource</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
<user-data-constraint>
<!-- transport-guarantee can be CONFIDENTIAL, INTEGRAL, or NONE -->
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>

security-v2-spring.xml:

<security:http auto-config="true"  use-expressions="true">      <security:intercept-url pattern="/rest/*" access="admin" />
<security:http-basic />
</security:http>
<security:authentication-manager>
<security:authentication-provider>
<security:user-service>
<security:user name="ash" password="ash" authorities="admin" />
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>

tomcat-users.xml：

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
<role rolename="manager"/>
<role rolename="admin"/>
<user username="ash" password="ash" roles="admin,manager"/>
</tomcat-users>

配置/local.properties：

hybris.security.http.basic.auth.enable=true
hybris.security.http.basic.auth.username=ash
hybris.security.http.basic.auth.password=ash

tomcat-users.xml位置在server.xml中也已正确配置

<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />

我尝试访问的endpointURL是

https://localhost:9002/rest/v2/**/**/**

通常的管理控制台admin/NIMDA也不起作用。一个多星期以来我都在为这件事折腾。任何帮助都会很大。提前道谢。

Answer 1

从URL中可以看出，您似乎正在尝试访问OCC API。
访问OCC与常规身份验证无关。
您需要使用OAuthClientDetails模型创建OAuth客户端，并给予其适当的授权。示例-

INSERT_UPDATE OAuthClientDetails;clientId[unique=true];resourceIds;scope;authorizedGrantTypes;clientSecret;authorities
                                ;abc;hybris;basic;authorization_code,refresh_token,password,client_credentials;password;ROLE_TRUSTED_CLIENT