Spring Security OAuth2正确的授权管理器

Question

我尝试配置Spring Security OAuth2。我必须配置身份验证管理器：客户端身份验证管理器和身份验证管理器。如果我正确理解了客户端身份验证管理器（clientAuthenticationManager）用于客户端授权（通过客户端id和客户端机密）和用户授权（通过用户登录和密码）对吗？

但是当我调试我的应用程序时，我看到当我发送http://localhost:8080/myApp/oauth/token请求时，自动化是由AuthManager（不是clientAuthentiationManager）进行的。

我的配置：

    <?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
    xmlns:sec="http://www.springframework.org/schema/security"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
    http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd" >

    <http pattern="/oauth/token" create-session="stateless"
        authentication-manager-ref="authenticationManager"
        xmlns="http://www.springframework.org/schema/security">
    <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <anonymous enabled="false" />
    <http-basic entry-point-ref="clientAuthenticationEntryPoint" />

    <custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
    </http>

    <http pattern="/API/**" create-session="never"
        entry-point-ref="oauthAuthenticationEntryPoint"
        access-decision-manager-ref="accessDecisionManager"
        xmlns="http://www.springframework.org/schema/security">
    <anonymous enabled="false" />

    <intercept-url pattern="/API/**" access="ROLE_RESTREAD" method="GET" />
    <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>

<http auto-config="false" use-expressions="true"
    disable-url-rewriting="true">
    <intercept-url pattern="/isSessionValid" access="permitAll"
        requires-channel="any" />
    <intercept-url pattern="/**" access="isAuthenticated()"
        requires-channel="any" />
    <form-login login-page="/login" authentication-failure-url="/loginFailed"
        default-target-url="/loginSuccess" always-use-default-target="true" />
    <logout logout-success-url="/login" />
    <session-management>
        <concurrency-control max-sessions="1" />
    </session-management>
</http>

<oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices">  
    <oauth:client-credentials />  
</oauth:authorization-server>
<oauth:resource-server id="resourceServerFilter" token-services-ref="tokenServices" />
<oauth:expression-handler id="oauthExpressionHandler" />
<oauth:web-expression-handler id="oauthWebExpressionHandler" />

<beans:bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore" >
    <beans:constructor-arg ref="dataSource" />
</beans:bean>
<beans:bean id="clientDetails" class="org.springframework.security.oauth2.provider.client.JdbcClientDetailsService" >
    <beans:constructor-arg ref="dataSource" />
</beans:bean>
<beans:bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <beans:property name="tokenStore" ref="tokenStore" />
    <beans:property name="supportRefreshToken" value="false" />
    <beans:property name="clientDetailsService" ref="clientDetails" />
    <beans:property name="accessTokenValiditySeconds" value="400000" />
    <beans:property name="refreshTokenValiditySeconds" value="0" />
</beans:bean>
<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" >
    <beans:constructor-arg>
        <beans:list>
            <beans:bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
            <beans:bean class="org.springframework.security.access.vote.RoleVoter" />
            <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
        </beans:list>
    </beans:constructor-arg>
</beans:bean>
<beans:bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <beans:property name="realmName" value="theRealm" />
</beans:bean>
<beans:bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <beans:property name="realmName" value="theRealm/client" />
    <beans:property name="typeName" value="Basic" />
</beans:bean>
<beans:bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <beans:property name="authenticationManager" ref="clientAuthenticationManager" />
</beans:bean>
<beans:bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
    <beans:constructor-arg ref="clientDetails" />
</beans:bean>
<beans:bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
<global-method-security pre-post-annotations="enabled" proxy-target-class="true">
    <expression-handler ref="oauthExpressionHandler" />
</global-method-security>
<authentication-manager alias="clientAuthenticationManager">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>


<beans:bean id="userRepository" class="pl.execon.grm.repository.UserRepository">
    <beans:property name="sessionFactory" ref="sessionFactory" />
</beans:bean>

<beans:bean id="userDetailsService" class="pl.execon.grm.auth.GRMUserDataService">
    <beans:property name="userRepository" ref="userRepository" />
</beans:bean>

<authentication-manager alias="authManager">
    <authentication-provider user-service-ref='userDetailsService'>
        <password-encoder hash="md5" />
    </authentication-provider>
</authentication-manager>

Answer 1

我发现了问题的根源：

在代码中：

<authentication-manager alias="clientAuthenticationManager">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>

我写的别名不是id，所以应该是：

<authentication-manager id="clientAuthenticationManager">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>

当我使用别名时，默认的身份验证管理器被用来解决OAuth客户端的问题。