使用Postman访问由Spring Boot 2和OAuth 2保护的REST API

Question

我正在使用Spring Boot 2和Spring Security 5构建REST API服务器。我正在使用基于OAuth2的IDP，它在远程服务器上运行，我能够将OAuth2客户端配置为使用IDP，当我尝试从Web浏览器点击任何url时，它会显示Spring生成的UI。https://imgur.com/3x98x5A.png

我能够完成身份验证流程，并且能够从Web浏览器访问安全资源。

现在，我尝试使用Postman执行同样的操作，在这里我生成了访问令牌，并要求Postman使用请求头将令牌传递给我的API服务器（资源服务器），如下所示：https://imgur.com/z4OvUu4.png

但是，当我对API执行GET请求时，它会返回spring生成的登录页面的HTML：(

我的Spring启动application.properties文件如下：

spring.security.oauth2.client.registration.wso2.client-id=<removed>
spring.security.oauth2.client.registration.wso2.client-secret=<removed>
spring.security.oauth2.client.registration.wso2.client-authentication-method=basic
spring.security.oauth2.client.registration.wso2.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.wso2.redirect-uri-template={baseUrl}/login/oauth2/code/{registrationId}
spring.security.oauth2.client.registration.wso2.scope = openid, profile
spring.security.oauth2.client.registration.wso2.client-name=WSO2 ID Provider

spring.security.oauth2.client.provider.wso2.authorization-uri=https://localidpserver:9443/oauth2/authorize
spring.security.oauth2.client.provider.wso2.token-uri=https://localidpserver:9443/oauth2/token
spring.security.oauth2.client.provider.wso2.user-info-uri=https://localidpserver:9443/oauth2/userinfo
spring.security.oauth2.client.provider.wso2.jwk-set-uri=https://localidpserver:9443/oauth2/jwks

我的POM文件如下：

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.okta.developer</groupId>
    <artifactId>oidc</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>oidc</name>
    <description>Demo project for Spring Boot</description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.2.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webflux</artifactId>
        </dependency>
        <dependency>
           <groupId>org.springframework.security</groupId>
           <artifactId>spring-security-config</artifactId>
        </dependency>
        <dependency>
           <groupId>org.springframework.security</groupId>
           <artifactId>spring-security-oauth2-client</artifactId>
        </dependency>
        <dependency>
           <groupId>org.springframework.security</groupId>
           <artifactId>spring-security-oauth2-jose</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>io.projectreactor</groupId>
            <artifactId>reactor-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>


</project>

我非常感谢您的回复：）

Answer 1

有待确认，但由于基于Servlet框架的Spring Security实现，Spring SecurityOauth与Spring Boot 2.0的Webflux实现不兼容。

您需要移动到2.1.0。M1和Spring Security 5.1.0。M1，检查

• microservices-spring-boot-2-oauth