当前位置: 首页 > 知识库问答 >
问题:

如何在spring oauth2中获取访问令牌

林星阑
2023-03-14

下面是security.xml文件,我正在使用它合并spring-security-oauth2。

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:sec="http://www.springframework.org/schema/security" xmlns:mvc="http://www.springframework.org/schema/mvc"
xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
    http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd 
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd ">


<!-- @author Nagesh.Chauhan(neel4soft@gmail.com) -->
<!-- This is default url to get a token from OAuth -->
<http pattern="/oauth/token" create-session="stateless"
    authentication-manager-ref="clientAuthenticationManager"
    xmlns="http://www.springframework.org/schema/security">
    <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
    <anonymous enabled="false" />
    <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
    <!-- include this only if you need to authenticate clients via request 
        parameters -->
    <custom-filter ref="clientCredentialsTokenEndpointFilter"
        after="BASIC_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>

<!-- This is where we tells spring security what URL should be protected 
    and what roles have access to them -->
<http pattern="/api/**" create-session="never"
    entry-point-ref="oauthAuthenticationEntryPoint"
    access-decision-manager-ref="accessDecisionManager"
    xmlns="http://www.springframework.org/schema/security">
    <anonymous enabled="false" />
    <intercept-url pattern="/api/**" access="ROLE_APP" />
    <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>


<bean id="oauthAuthenticationEntryPoint"
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <property name="realmName" value="test" />
</bean>

<bean id="clientAuthenticationEntryPoint"
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <property name="realmName" value="test/client" />
    <property name="typeName" value="Basic" />
</bean>

<bean id="oauthAccessDeniedHandler"
    class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />

<bean id="clientCredentialsTokenEndpointFilter"
    class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <property name="authenticationManager" ref="clientAuthenticationManager" />
</bean>

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
    xmlns="http://www.springframework.org/schema/beans">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
            <bean class="org.springframework.security.access.vote.RoleVoter" />
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
        </list>
    </constructor-arg>
</bean>

<authentication-manager id="clientAuthenticationManager"
    xmlns="http://www.springframework.org/schema/security">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>


<!-- This is simple authentication manager, with a hardcoded user/password 
    combination. We can replace this with a user defined service to get few users 
    credentials from DB -->
<authentication-manager alias="authenticationManager"
    xmlns="http://www.springframework.org/schema/security">
    <authentication-provider>
        <user-service>
            <user name="beingjavaguys" password="spring@java" authorities="ROLE_APP" />
        </user-service>
    </authentication-provider>
</authentication-manager>

<bean id="clientDetailsUserService"
    class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
    <constructor-arg ref="clientDetails" />
</bean>


<!-- This defined token store, we have used inmemory tokenstore for now 
    but this can be changed to a user defined one -->
<bean id="tokenStore"
    class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" />

<!-- This is where we defined token based configurations, token validity 
    and other things -->
<bean id="tokenServices"
    class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <property name="tokenStore" ref="tokenStore" />
    <property name="supportRefreshToken" value="true" />
    <property name="accessTokenValiditySeconds" value="120" />
    <property name="clientDetailsService" ref="clientDetails" />
</bean>

<bean id="userApprovalHandler"
    class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler">
    <property name="tokenServices" ref="tokenServices" />
</bean>

<oauth:authorization-server
    client-details-service-ref="clientDetails" token-services-ref="tokenServices"
    user-approval-handler-ref="userApprovalHandler">
    <oauth:authorization-code />
    <oauth:implicit />
    <oauth:refresh-token />
    <oauth:client-credentials />
    <oauth:password />
</oauth:authorization-server>

<oauth:resource-server id="resourceServerFilter"
    resource-id="test" token-services-ref="tokenServices" />

<oauth:client-details-service id="clientDetails">
    <!-- client -->
    <oauth:client client-id="restapp"
        authorized-grant-types="authorization_code,client_credentials"
        authorities="ROLE_APP" scope="read,write,trust" secret="secret" />

    <oauth:client client-id="restapp"
        authorized-grant-types="password,authorization_code,refresh_token,implicit"
        secret="restapp" authorities="ROLE_APP" />

</oauth:client-details-service>

<sec:global-method-security
    pre-post-annotations="enabled" proxy-target-class="true">
    <!--you could also wire in the expression handler up at the layer of the 
        http filters. See https://jira.springsource.org/browse/SEC-1452 -->
    <sec:expression-handler ref="oauthExpressionHandler" />
</sec:global-method-security>

<oauth:expression-handler id="oauthExpressionHandler" />
<oauth:web-expression-handler id="oauthWebExpressionHandler" />

我必须在spring-security.xml文件中做哪些更改,以便在JSON中发送查询参数?

共有1个答案

葛昕
2023-03-14

不支持开箱即用的AFAIK。为此,您必须编写自己的REST服务接口。

然而,您建议的格式看起来也不像支持的版本那样“像REST”(应该使用GET请求来检索信息)。至少当您将其视为检索而不是创建令牌时。

 类似资料:
  • 在我的web应用程序中,我使用Firebase进行身份验证,要访问任何API,我必须从Firebase进行身份验证。 问题:如何在Postman中获取firebase的访问令牌? 我有两种解决此问题的方法: 1) 在postman中从firebase获取访问令牌,并将该访问令牌存储在postman global env中。变量,然后我可以执行其他API请求。(这里我不知道如何在邮递员那里获得访问令

  • 我有一个由 AAD B2C 访问令牌保护的 REST API。我现在想要添加可用于 API 负载测试的 Web 测试。 我跌跌撞撞地从AADB2C为我的测试用户获取了一个有效的访问令牌。我想以某种方式从对AADB2C的REST API调用中获取一个令牌作为响应。 在网上朝这个方向看,我已经找到了许多指向这个没有记录的endpoint的页面 其中我需要提供一些参数。到目前为止,我发现 < li >客

  • 我已经实现了FacebookSDK,借助它可以通过以下代码获得facebook身份验证和用户信息。 但是要发布提要(https://graph.facebook.com/me/feed/access_token=)从这个登录用户我需要访问令牌。如果有人知道如何在iOS 6.0中获取访问令牌,请帮助我。 感谢所有人。

  • 获取访问令牌的文档中的第一步是“将用户引导到我们的授权URL”。那到底是什么意思?没有提供链接或任何东西。它还说“公司名称、联系电子邮件和隐私政策URL是开始提交的必要条件。”我们的应用程序没有隐私政策...只是一个简单的标签提要。我不明白为什么有一个简单的标签提要那么复杂。 是否有一个等待时间来获得批准的应用程序..如果它得到批准...在获得访问令牌之前,我必须获得批准吗?这在任何地方都没有概述

  • 我正在尝试通过Twython验证用户的Twitter帐户 我得到了 Twitter API返回401(未经授权)、无效/过期令牌 回溯(最近一次调用): 文件“/Users/bharatagarwal/my-venv/lib/python2.7/site-packages/django/core/handers/base.py”,第149行,get_response-response=self。p

  • 我正在按照本教程从我的“发现周刊”播放列表中获取曲目列表。本教程提到,在请求播放列表信息之前,我需要为自己的帐户获取OAuth令牌。这是通过转到随机的控制台页面并单击页面末尾的“获取令牌”来完成的(这需要我登录我的Spotify帐户并批准控制台访问我的帐户数据)。 然而,我想以编程方式获取此令牌,而不是每次需要此令牌时手动单击“获取令牌”并登录到我的帐户。我拥有的是: > 我的Spotify用户I