Spring oauth2服务器，无法验证令牌

Question

我从spring boot oauth2服务器生成JWT令牌，但当我想使用'http://auth_server/oauth/check_token'endpoint验证此JWT令牌时，我将post请求发送到此endpoint，并将JWT包含在授权头中，得到401-未经授权的http错误代码。

我从服务器得到的结果是：

{
    "timestamp": "2020-03-19T16:28:39.999+0000",
    "status": 401,
    "error": "Unauthorized",
    "message": "Unauthorized",
    "path": "/oauth/check_token"
}

为什么oauth服务器返回401？

下面是我对oauth服务器的实现：

    @Configuration
    @EnableAuthorizationServer
    public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

        @Autowired
        @Qualifier("authenticationManagerBean")
        private AuthenticationManager authenticationManager;

        @Autowired
        private ClientDetailsServiceImpl clientDetailsService;

        private String privateKey = "private key";

        @Value("${jwt.accessTokenValidititySeconds:43200}") // 12 hours
        private int accessTokenValiditySeconds;

        @Value("${jwt.authorizedGrantTypes: authorization_code}")
        private String[] authorizedGrantTypes;

        @Value("${jwt.refreshTokenValiditySeconds:2592000}") // 30 days
        private int refreshTokenValiditySeconds;

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
                clients.withClientDetails(clientDetailsService);
        }

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {      
            TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
            tokenEnhancerChain.setTokenEnhancers(
              Arrays.asList(tokenEnhancer(), accessTokenConverter()));

            endpoints.tokenStore(tokenStore())
            .accessTokenConverter(accessTokenConverter())
            .authenticationManager(authenticationManager);
        }

        @Override
        public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()").allowFormAuthenticationForClients();
        }


        @Bean
        public JwtAccessTokenConverter accessTokenConverter() {
           JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
           converter.setSigningKey(privateKey);
           return converter;
        }


        @Bean
        public TokenStore tokenStore() {
            return new JwtTokenStore(accessTokenConverter());
        }

        @Bean
        public TokenEnhancer tokenEnhancer() {
            return new CustomTokenEnhancer();
        }

        @Bean
        PasswordEncoder passwordEncoder() {
            return PasswordEncoderFactories.createDelegatingPasswordEncoder();
        }

    }

Answer 1

最后，我发现get请求应该发送到http://server.com/oauth/check_token？token=[access_token]，在授权头中使用客户端名称和密码来检查访问令牌的有效性。下面是邮递员的例子：