带表单登录的Spring Boot Security OAuth2

Question

我正在学习Spring Boot Security入门第五部分，以保护我的RESTful微服务。

我打算实现的简单流程是：-

>

如果未经身份验证，用户将被重定向到一个自定义登录页，地址是'/login'。

用户提供他的凭据。

上面提到的链接中的入门指南使用了在。properties或。yml文件中配置的基本Auth和虚拟用户。

这是我尝试配置的方式：-

@Configuration
@EnableAuthorizationServer
public class OAuth2Config extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().withClient("acme").secret("acmesecret")
                .authorizedGrantTypes("authorization_code", "refresh_token", "password").scopes("openid")
                .accessTokenValiditySeconds(3600);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.tokenKeyAccess("isAnonymous()").checkTokenAccess("isAnonymous()")
                .allowFormAuthenticationForClients();
    }

}



@Configuration
@Import({ OptoSoftSecurityServiceConfig.class })
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService; // backed by MongoDB

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.httpBasic().disable().formLogin();// disabled basic auth and configured to use dafault Spring Security form login.
    }
}

单击授权endpoint会将我重定向到“http://localhost:9999/uaa/login”，错误消息如下：-

<oauth>
<error_description>
Full authentication is required to access this resource
</error_description>
<error>unauthorized</error>
</oauth>

问题

>

如何将授权服务器配置为使用UserDetailsService而不是静态用户，并使用表单登录而不是基本Auth。

如何在使用“authorization_code”作为授权类型时配置自动审批？

/oauth/authorizeendpoint是否必须受基本auth的保护？为什么“需要完全身份验证”才能访问/oauth/authorize“endpoint。我相信我们不知道谁是这个endpoint之前的用户。只有使用表单登录后的有效凭据对用户进行身份验证后，才能识别该用户。

Answer 1

终于让它起作用了。上面提到的博客中的git repo已经配置了这个东西。结果很直接。

这对我很有效（我还将自动审批配置为true）：-

**
 * @author kumar
 *
 */
@SpringBootApplication
public class AuthenticationServerApplication {

    /**
     * @param args
     */
    public static void main(String[] args) {
        SpringApplication.run(AuthenticationServerApplication.class, args);

    }

    @Configuration
    protected static class LoginConfig extends WebSecurityConfigurerAdapter {

        @Autowired
        private AuthenticationManager authenticationManager;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.formLogin().permitAll().and().authorizeRequests().anyRequest().authenticated();//.and().userDetailsService(yourCustomerUserDetailsService);
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.parentAuthenticationManager(authenticationManager);
        }
    }

    @Configuration
    @EnableAuthorizationServer
    protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private AuthenticationManager authenticationManager;

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.authenticationManager(authenticationManager);
        }

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory().withClient("acme").secret("acmesecret")
                    .authorizedGrantTypes("authorization_code", "refresh_token", "password").scopes("openid")
                    .autoApprove(true);
        }

        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
        }

    }

}

申请。yml：-

  security:
      user:
        password: password
    server:
      port: 9999
      context-path: /uaa