spring-boot OAuth2客户端配置

我尝试使用spring-boot授权流授权流实现OAuth2客户端。但它不起作用。spring-boot OAuth2客户端配置

“http://external_server/oauth/authorize”被调用，但没有添加GET参数。

有没有人知道下面的配置有什么问题？

验证提供程序由doorkeeper实现，并且它已经在工作。因此WebSecurityConfiguration中的URL常量是正确的。

@Configuration 
@EnableWebMvcSecurity 
@EnableOAuth2Client 
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { 

    private static final String AUTH_ENDPOINT = "http://external_server"; 
    private static final String LOGIN_URL = AUTH_ENDPOINT + "https://stackoverflow.com/users/sign_in"; 
    private static final String LOGOUT_URL = AUTH_ENDPOINT + "/sign_out"; 

    private static final String AUTH_URL = AUTH_ENDPOINT + "/oauth/authorize"; 
    private static final String ACCESS_TOKEN_URL = AUTH_ENDPOINT + "/oauth/token"; 

    @Autowired OAuth2ClientContext oAuth2ClientContext; 

    /** 
    * for specific api 
    */ 
    @Bean public RestTemplate restTemplate() { 
    return new RestTemplate(); 
    } 

    /** 
    * for accessing protected resource 
    */ 
    @Bean public OAuth2RestTemplate oAuth2RestTemplate() { 
    return new OAuth2RestTemplate(resource(), oAuth2ClientContext); 
    } 

    @Bean protected OAuth2ProtectedResourceDetails resource() { 

    AuthorizationCodeResourceDetails resource = new AuthorizationCodeResourceDetails(); 
    resource.setClientId("_xxx_"); 
    resource.setClientSecret("_yyy_"); 
    resource.setUserAuthorizationUri(AUTH_URL); 
    resource.setAccessTokenUri(ACCESS_TOKEN_URL); 

    return resource; 
    } 

    @Override public void configure(WebSecurity web) throws Exception { 
    web.debug(true).ignoring().antMatchers("/webjars/**", "/css/**"); 
    } 

    @Override protected void configure(HttpSecurity http) throws Exception { 
    //@formatter:off 
    http.csrf().disable().authorizeRequests() 
     .antMatchers("/", "/callback") 
     .permitAll() 
     .anyRequest() 
     .authenticated(); 

    http.formLogin() 
     .loginPage(AUTH_URL) 
     .loginProcessingUrl(LOGIN_URL); 

    http.httpBasic() 
     .disable(); 
    //@formatter:on 
    } 
}

来源

2015-06-19 Yuki Yoshida

OAuth2ProtectedResourceDetails在OAuth2RestTemplate设置，以便它会知道什么样的补助流你想用。事实上，你并没有利用它。 –

@ bajada93感谢您的评论！我修复了Configuration类来注入OAuth2RestTemplate，但仍然无法工作。 –

您需要添加一个[OAuth2ClientAuthenticationProcessingFilter]（https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/ oauth2/client/filter/OAuth2ClientAuthenticationProcessingFilter.java）添加到Spring Security Filter Chain中，并在其中注入OAuth2RestTemplate。这应该够了吧。 –

默认情况下，只启用POST方法。您可能需要在AuthorizationConfig中包含GET方法。

.allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST);

会是这样：

@Configuration 
@EnableAuthorizationServer 
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter { 
    .... 
    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer endpoints){ 
     endpoints.authenticationManager(authenticationManager) 
       .allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST); 
    } 
}

在春天的Oauth的源代码，我们有：

private Set<HttpMethod> allowedTokenEndpointRequestMethods() { 
     // HTTP POST should be the only allowed endpoint request method by default. 
     if (allowedTokenEndpointRequestMethods.isEmpty()) { 
      allowedTokenEndpointRequestMethods.add(HttpMethod.POST); 
     } 
     return allowedTokenEndpointRequestMethods; 
    }

来源

2018-02-14 18:15:32

spring-boot OAuth2客户端配置

回答

相关问题