Spring Security OAuth-如何启用私有或公共访问令牌访问不同的资源？

Question

我有两个终点。

是一个内部（半私有）endpoint。仅允许配置的客户端使用。（不需要用户名和凭据；但clientID就足够了）

问候语是专用endpoint。仅允许客户端和用户配置。（需要clientID、用户名和密码）

以下是配置。

@Configuration
public class OAuth2ServerConfiguration {

    private static final String RESOURCE_ID = "restservice";

    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends
            ResourceServerConfigurerAdapter {

        @Override
        public void configure(ResourceServerSecurityConfigurer resources) {
            // @formatter:off
            resources
                .resourceId(RESOURCE_ID);
            // @formatter:on
        }

        @Override
        public void configure(HttpSecurity http) throws Exception {
            // @formatter:off
            http
                .authorizeRequests()
                    .antMatchers("/users").hasRole("ADMIN")
                    .antMatchers("/greeting").authenticated()
                    .antMatchers("/foo").authenticated();
            // @formatter:on
        }

    }

    @Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends
            AuthorizationServerConfigurerAdapter {

        private TokenStore tokenStore = new InMemoryTokenStore();

        @Autowired
        @Qualifier("authenticationManagerBean")
        private AuthenticationManager authenticationManager;

        @Autowired
        private CustomUserDetailsService userDetailsService;

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints)
                throws Exception {
            // @formatter:off
            endpoints
                .tokenStore(this.tokenStore)
                .authenticationManager(this.authenticationManager)
                .userDetailsService(userDetailsService);
            // @formatter:on
        }

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            // @formatter:off
            clients
                .inMemory()
                    .withClient("clientapp")
                        .authorizedGrantTypes("password", "refresh_token","authorization_code")
                        .authorities("USER","ROLE_CLIENT")
                        .scopes("read", "write")
                        .resourceIds(RESOURCE_ID)
                        .secret("123456")
                        .accessTokenValiditySeconds(600);
            // @formatter:on
        }

        @Bean
        @Primary
        public DefaultTokenServices tokenServices() {
            DefaultTokenServices tokenServices = new DefaultTokenServices();
            tokenServices.setSupportRefreshToken(true);
            tokenServices.setTokenStore(this.tokenStore);
            return tokenServices;
        }

        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception
        {
           oauthServer.checkTokenAccess("permitAll()");
        }

    }

}

这是控制器

@RestController
public class GreetingController {

    private static final String template = "Hello, %s! your password is %s";

    private final AtomicLong counter = new AtomicLong();

    @RequestMapping("/greeting")
    public Greeting greeting(@AuthenticationPrincipal User user) {
        return new Greeting(counter.incrementAndGet(), String.format(template, user.getName(),user.getPassword()));
    }

    @RequestMapping("/foo")
    public String foo(@AuthenticationPrincipal User user) {
        System.out.println(user==null);
        return "you are permitted here";
    }

}

我不能访问http://localhost:9001/foo没有任何令牌。所以当我尝试使用下面的curl获取访问令牌时（注意我不传递用户名和密码，只传递client_id和client_secret）

Curl-X POST-vu clientapp： 123456http://localhost:9001/oauth/token-H"接受：应用程序/json"-d"grant_type=密码

我得到这个错误

{"error":"invalid_grant","error_description":"Bad credentials"}

我的配置有问题。我是使用Spring SecurityOAuths的初学者。请在这里提供任何帮助。

谢啦




Answer 1

我想你传错了。。。

curl -X POST -vu clientapp:123456 http://localhost:9001/oauth/token -H "Accept: application/json" -d "grant_type=client_credentials&scope=read%20write&client_secret=123456&client_id=clientapp"

另外，据我所知，您不应该在请求的头和正文中重复client_id和client_secret...只有头应该就足够了