在没有XML配置的情况下实现Spring Security Oauth

Question

我正在尝试构建一个基本的REST服务，它使用Spring Security和OAuth2.0身份验证和授权进行安全保护。

我试图限制所涉及的元素，所以我不是复制粘贴依赖于Spring bean、Spring MVC等的Spring Security Oath XML配置，而是直接使用Spring Security Oauth类。

尝试从/oauth/Token获取访问令牌时遇到了一个障碍。我可能缺少一些基本的东西，但是Spring Security和Spring Security Oauth都很难让我理解，我似乎找不到一个不需要使用额外框架的示例或教程。

有人能看出我错在哪里吗？

RestService.java

@Path("/members")
public class RestService {

    @Secured({"ROLE_USER"})
    @GET
    @Path("/{id}")
    @Produces(MediaType.TEXT_PLAIN)
    public Response readMember(@PathParam("id") String id) {

        String output;
        if(Integer.valueOf(id) < members.size())
        {
            output = members.get(Integer.valueOf(id)).toString();
        }
        else
        {
            output = "No such member.";
        }

        return Response.status(200).entity(output).build();
    }
}

public class OAuthServices {

    static private DefaultTokenServices tokenServices = new DefaultTokenServices();
    static private InMemoryClientDetailsService clientDetailsService = new InMemoryClientDetailsService();

    static {
        Map<String, ClientDetails> clientDetailsStore = new HashMap<String, ClientDetails>();
        BaseClientDetails clientDetails = new BaseClientDetails("client", "resource", null, null, "read,write");
        clientDetailsStore.put("client", clientDetails);
        clientDetailsService.setClientDetailsStore(clientDetailsStore);
    }

    public static DefaultTokenServices getTokenServices() {
        return tokenServices;
    }

    public static InMemoryClientDetailsService getClientDetailsService() {
        return clientDetailsService;
    }
}

@EnableAuthorizationServer
@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(securedEnabled=true)
public class SecurityConfig extends WebSecurityConfigurerAdapter implements AuthorizationServerConfigurer {

    @Configuration
    protected static class AuthenticationConfiguration extends
            GlobalAuthenticationConfigurerAdapter {

        @Override
        public void init(AuthenticationManagerBuilder auth) throws Exception {
            auth
                    .inMemoryAuthentication()
                    .withUser("user").password("password").roles("USER")
                    .and()
                    .withUser("admin").password("password").roles("USER", "ADMIN");
        }

    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security)
            throws Exception {
        // TODO Auto-generated method stub

    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients)
            throws Exception {
        // TODO Auto-generated method stub

    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints)
            throws Exception {
        // TODO Auto-generated method stub

    }
}

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
    <servlet>
        <servlet-name>jersey-helloworld-servlet</servlet-name>
        <servlet-class>
                     org.glassfish.jersey.servlet.ServletContainer
                </servlet-class>
                <init-param>
            <param-name>jersey.config.server.provider.packages</param-name>
            <param-value>com.excentus.springsecurity.rest.test</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>jersey-helloworld-servlet</servlet-name>
        <url-pattern>/rest/*</url-pattern>
    </servlet-mapping>
</web-app>

Answer 1

我可以看到2个错误（也许不是整个故事）。

>

您使用的是web.xml但这里没有定义Spring Security过滤器。这是锅炉板代码，但您必须这样做（除非您切换到使用Spring Boot编写应用程序的更现代的方式）。示例（来自文档）：

springSecurityFilterChain org.SpringFramework.Web.Filter.DelegatingFilterProxy

    @Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.inMemory()
        .withClient("my-trusted-client")
            .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
            .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
            .scopes("read", "write", "trust")
            .resourceIds("oauth2-resource")
            .accessTokenValiditySeconds(60);
}

您的静态便利类oauthservices也是一种反模式，但它不会破坏任何东西（我也没有看到它在任何地方被使用，但可能错过了）。