Spring Security OAuth2资源服务器始终返回无效令牌

Question

>

访问oauth授权URI以启动OAuth2流：http://localhost:8080/server/oauth/authorize？response_type=code&client_id=client

重定向到登录页面：http://localhost:8080/server/login

使用代码参数：http://localhost:8080/client？code=hmjo4k处理审批并重定向到我的配置重定向页

使用基本身份验证构造GET请求，使用客户端id和secret以及授予类型和代码：http://localhost:8080/server/oauth/token？grant_type=authorization_code&code=hmjo4k

接收access_token并刷新token对象

{access_token:“f853bcc5-7801-42d3-9cb8-303fc67b0453”token_type:“barer”refresh_token:“57100377-dea9-4df0-adab-62e33f2a1b49”expires_in:299范围：“读写”}

尝试使用access_token访问受限资源：http://localhost:8080/server/me？access_token=f853bcc5-7801-42d3-9cb8-303fc67b0453

接收无效令牌回复

{error:“invalid_token”error_description：“无效访问令牌:F853BCC5-7801-42D3-9CB8-303FC67B0453”}

{access_token:“ED104994-899C-4CD9-8860-43D5689A9420”token_type:“barer”refresh_token:“57100377-DEA9-4DF0-ADAB-62E33F2A1B49”expires_in:300作用域：“读写”}

我真的不确定我做错了什么，但似乎除了访问受限制的uri之外，其他的一切都在工作。下面是我的配置：

@Configuration
public class Oauth2ServerConfiguration {

    private static final String SERVER_RESOURCE_ID = "oauth2-server";

    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

        @Override
        public void configure(ResourceServerSecurityConfigurer resources) {
            resources.resourceId(SERVER_RESOURCE_ID);
        }

        @Override
        public void configure(HttpSecurity http) throws Exception {
            http
                .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                .and().requestMatchers()
                    .antMatchers("/me")
                .and().authorizeRequests()
                    .antMatchers("/me").access("#oauth2.clientHasRole('ROLE_CLIENT')")
            ;
        }
    }

    @Configuration
    @EnableAuthorizationServer
    protected static class AuthotizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private ClientDetailsService clientDetailsService;

        @Autowired
        @Qualifier("authenticationManagerBean")
        private AuthenticationManager authenticationManager;

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()
                .withClient("client")
                    .resourceIds(SERVER_RESOURCE_ID)
                    .secret("secret")
                    .authorizedGrantTypes("authorization_code", "refresh_token")
                    .authorities("ROLE_CLIENT")
                    .scopes("read","write")
                    .redirectUris("http://localhost:8080/client")
                    .accessTokenValiditySeconds(300)
                    .autoApprove(true)
            ;
        }

        @Bean
        public TokenStore tokenStore() {
            return new InMemoryTokenStore();
        }

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints
                .tokenStore(tokenStore())
                .userApprovalHandler(userApprovalHandler())
                .authenticationManager(authenticationManager)
            ;
        }

        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer.realm("oauth");
        }

        @Bean
        public ApprovalStore approvalStore() throws Exception {
            TokenApprovalStore store = new TokenApprovalStore();
            store.setTokenStore(tokenStore());
            return store;
        }

        @Bean
        public UserApprovalHandler userApprovalHandler() throws Exception {
            TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
            handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
            handler.setClientDetailsService(clientDetailsService);
            handler.setTokenStore(tokenStore());

            return handler;
        }
    }
}

是我错过了什么，还是我不正确地对待这件事？如有任何帮助，将不胜感激。

Answer 1

问题最终是资源服务器和授权服务器没有获得相同的令牌存储引用。不确定布线是如何不正常工作的，但在configuration类中使用一个固定对象就像一个魅力。最后，我将转移到支持持久性的令牌存储，它可能不会有任何问题。

感谢@ohadr的回答和帮助！

最终，我简化了配置，经过了相同的工作流程，结果成功了

@Configuration
public class Oauth2ServerConfiguration {

    private static final String SERVER_RESOURCE_ID = "oauth2-server";

    private static InMemoryTokenStore tokenStore = new InMemoryTokenStore();


    @Configuration
    @EnableResourceServer
    protected static class ResourceServer extends ResourceServerConfigurerAdapter {

        @Override
        public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
            resources.tokenStore(tokenStore).resourceId(SERVER_RESOURCE_ID);
        }

        @Override
        public void configure(HttpSecurity http) throws Exception {
            http.requestMatchers().antMatchers("/me").and().authorizeRequests().antMatchers("/me").access("#oauth2.hasScope('read')");
        }
    }

    @Configuration
    @EnableAuthorizationServer
    protected static class AuthConfig extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private AuthenticationManager authenticationManager;


        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.authenticationManager(authenticationManager).tokenStore(tokenStore).approvalStoreDisabled();
        }

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()
                .withClient("client")
                    .authorizedGrantTypes("authorization_code","refresh_token")
                    .authorities("ROLE_CLIENT")
                    .scopes("read")
                    .resourceIds(SERVER_RESOURCE_ID)
                    .secret("secret")
            ;
        }
    }
}