使用spring boot 1.5在oauth2实现中返回错误凭据

Question

因为我正在尝试使用spring Boot在oauth2实现中创建简单的登录。不幸的是它不起作用，因为我是spring我的配置的新手

ApplicationStarter.java

@SpringBootApplication
@EnableAutoConfiguration

public class ApplicationStarter extends SpringBootServletInitializer {
     @Override
        protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
            return application.sources(ApplicationStarter.class);
        }
    public static void main(String[] args) throws Exception {
        SpringApplication.run(ApplicationStarter.class, args);
    }
}

ResourceServerConfiguration.java

@Configuration

@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    private static final String RESOURCE_ID = "my_rest_api";

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId(RESOURCE_ID);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
           System.out.println("Inside ResourceServerConfiguration");
        http.
        anonymous().disable()
        .requestMatchers().antMatchers("/user/**")
        .and().authorizeRequests()
        .antMatchers("/user/**").access("hasRole('ADMIN')")
        .and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
    }

}

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

    private static String REALM="MY_OAUTH_REALM";

    @Autowired
    private TokenStore tokenStore;

    @Autowired
    private UserApprovalHandler userApprovalHandler;

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
           System.out.println("Inside AuthorizationServerConfiguration");
        clients.inMemory()
            .withClient("my-trusted-client")
            .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
            .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
            .scopes("read", "write", "trust")
            .secret("secret")
            .accessTokenValiditySeconds(120).//Access token is only valid for 2 minutes.
            refreshTokenValiditySeconds(600);//Refresh token is only valid for 10 minutes.
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
                .authenticationManager(authenticationManager);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.realm(REALM+"/client");
    }

}

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    @Autowired
    private OAuth2SecurityConfiguration securityConfig;

    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        return new OAuth2MethodSecurityExpressionHandler();
    }
}

OAuth2SecurityConfiguration.java

@Configuration

@ComponentScan
@EnableWebSecurity
public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private ClientDetailsService clientDetailsService;

    @Autowired
    public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
        System.out.println("inside OAuth2SecurityConfiguration : globalUserDetails()");
        auth.inMemoryAuthentication()
        .withUser("bill").password("abc123").roles("ADMIN").and()
        .withUser("bob").password("abc123").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        System.out.println("inside OAuth2SecurityConfiguration : configure()");
        http
        .csrf().disable()
        .anonymous().disable()
        .authorizeRequests()
        .antMatchers("/oauth/token").permitAll();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        System.out.println("inside OAuth2SecurityConfiguration : authenticationManagerBean()");
        return super.authenticationManagerBean();
    }


    @Bean
    public TokenStore tokenStore() {
        System.out.println("inside OAuth2SecurityConfiguration : tokenStore()");
        return new InMemoryTokenStore();
    }

    @Bean
    @Autowired
    public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
        System.out.println("inside OAuth2SecurityConfiguration : userApprovalHandler()");
        TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
        handler.setTokenStore(tokenStore);
        handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
        handler.setClientDetailsService(clientDetailsService);
        return handler;
    }

    @Bean
    @Autowired
    public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
        System.out.println("inside OAuth2SecurityConfiguration : approvalStore()");
        TokenApprovalStore store = new TokenApprovalStore();
        store.setTokenStore(tokenStore);
        return store;
    }

}

请纠正我哪里错了？是否需要更多的配置？

正如我跟随http://websystique.com/spring-security/secure-spring-rest-api-using-oauth2/作为参考一样。

Gradle.Build

> /*  * This build file was generated by the Gradle 'init' task.  *  *
> This generated file contains a sample Java Library project to get you
> started.  * For more details take a look at the Java Libraries chapter
> in the Gradle  * user guide available at
> https://docs.gradle.org/3.5/userguide/java_library_plugin.html  */
> buildscript {
>     ext { springBootVersion = '1.5.7.RELEASE' }
>     repositories { mavenCentral() }
>     dependencies { classpath("org.springframework.boot:spring-boot-gradle-plugin:${springBootVersion}")
> } } // Apply the java-library plugin to add support for Java Library
> apply plugin: 'java' apply plugin: 'eclipse' apply plugin:
> 'org.springframework.boot' apply plugin: 'war'
> 
> 
> sourceCompatibility = 1.8 // In this section you declare where to find
> the dependencies of your project repositories {
>     // Use jcenter for resolving your dependencies.
>     // You can declare any Maven/Ivy/file repository here.    // jcenter()    mavenCentral() }
> 
> dependencies {
>     // This dependency is exported to consumers, that is to say found on their compile classpath.
>     //api 'org.apache.commons:commons-math3:3.6.1'
>     //providedRuntime 'org.springframework.boot:spring-boot-starter-tomcat:1.5.2.RELEASE'
>     // This dependency is used internally, and not exposed to consumers on their own compile classpath.
>     implementation 'com.google.guava:guava:21.0'
> 
>     // Use JUnit test framework
>     testImplementation 'junit:junit:4.12'
>     
>    
>     // compile("org.springframework.boot:spring-boot-starter-security:1.4.1.RELEASE")
>     // compile("org.springframework.security.oauth:spring-security-oauth2:2.0.2.RELEASE")
> //  
> compile("org.springframework.security:spring-security-config:3.2.0.RELEASE")
>     //    compile("org.gitlab4j:gitlab4j-api:4.6.0")
>      //    compile("org.springframework.boot:spring-boot-starter-tomcat:1.5.2.RELEASE")
>          
>     compile('org.springframework.boot:spring-boot-starter-actuator')
>     compile('org.springframework.boot:spring-boot-starter-security')
>        compile('org.springframework.security.oauth:spring-security-oauth2')
>        compile('org.springframework.security:spring-security-config')
>     compile('org.springframework.boot:spring-boot-starter-web')
>     providedRuntime("org.springframework.boot:spring-boot-starter-tomcat")
>    
>     testCompile('org.springframework.boot:spring-boot-starter-test') }

Answer 1

像这样更改授权服务器配置

AuthorizationServerConfiguration.java

@Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
           System.out.println("Inside AuthorizationServerConfiguration");
        clients.inMemory()
            .withClient("my-trusted-client")
            .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
            .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
            .scopes("read", "write", "trust").resourceIds("my_rest_api")
            .secret("secret")
            .accessTokenValiditySeconds(120).//Access token is only valid for 2 minutes.
            refreshTokenValiditySeconds(600);//Refresh token is only valid for 10 minutes.
    }

这里的变化是我在作用域后面放了一个resourceIds，并且该资源id将与Resources服务器的resource_id相同。

您在ResourceServerConfiguration中这样声明

private static final String RESOURCE_ID = "my_rest_api";

所以我相信把这个字符串放到授权服务器里就可以解决你的问题了。
谢谢。