角色层次结构和OAuth2使用Spring Boot的安全性

我知道有大量有关角色层次结构的线程，但我找不到任何与OAuth2结合的示例。角色层次结构和OAuth2使用Spring Boot的安全性

所以，多数线程的点，我需要实现RoleHierarchy豆：

Beans.java

@EnableJpaRepositories(basePackages = "com.template.service.repository") 
@EnableAspectJAutoProxy 
@ComponentScan 
@Configuration 
public class Beans { 
@Bean 
public ItemService itemsService(ItemsRepository itemsRepository) { 
    return new ItemService(itemsRepository); 
} 

@Bean 
public RoleHierarchy roleHierarchy(){ 
    RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl(); 
    roleHierarchy.setHierarchy("ROLE_SUPREME > ROLE_DEVELOPER ROLE_DEVELOPER > ROLE_ADMIN ROLE_ADMIN > ROLE_USER"); 
    return roleHierarchy; 
} 

@Bean 
public DtoMapper dtoMapper() { 
    return new DtoMapper(); 
} 
}

接下来，我需要@Autowire这个bean我WebSecurityConfigurerAdapter。但是，因为我使用的是OAuth2安全性，因此我在ResourceServerConfigurerAdapter内配置了HttpSecurity。

OAuth2.java

public class OAuth2 { 
@EnableAuthorizationServer 
@Configuration 
@ComponentScan 
public static class AuthorizationServer extends AuthorizationServerConfigurerAdapter { 

    @Autowired 
    private AuthenticationManager authenticationManagerBean; 
    @Autowired 
    private UserDetailsService userDetailsService; 

    @Override 
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
     clients.inMemory() 
       .withClient("trusted_client") 
       .authorizedGrantTypes("password", "refresh_token") 
       .scopes("read", "write"); 
    } 

    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { 
     endpoints.authenticationManager(authenticationManagerBean).userDetailsService(userDetailsService); 
    } 

    @Override 
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception { 
     security.allowFormAuthenticationForClients(); 
    } 
} 

@EnableResourceServer 
@Configuration 
@ComponentScan 
public static class ResourceServer extends ResourceServerConfigurerAdapter { 

    @Autowired 
    private RoleHierarchy roleHierarchy; 

    private SecurityExpressionHandler<FilterInvocation> webExpressionHandler() { 
     OAuth2WebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new OAuth2WebSecurityExpressionHandler(); 
     defaultWebSecurityExpressionHandler.setRoleHierarchy(roleHierarchy); 
     return defaultWebSecurityExpressionHandler; 
    } 

    @Override 
    public void configure(HttpSecurity http) throws Exception { 
     http 
       .authorizeRequests().expressionHandler(webExpressionHandler()) 
       .antMatchers("/api/**").hasRole("DEVELOPER"); 
    } 
} 
}

Security.java

@EnableWebSecurity 
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) 
@Configuration 
@ComponentScan 
public class Security extends WebSecurityConfigurerAdapter { 

@Autowired 
private UserDetailsService userDetailsService; 

@Bean 
public JpaAccountDetailsService userDetailsService(AccountsRepository accountsRepository) { 
    return new JpaAccountDetailsService(accountsRepository); 
} 

@Override 
protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); 
} 

@Bean 
@Override 
public AuthenticationManager authenticationManagerBean() throws Exception { 
    return super.authenticationManagerBean(); 
} 

@Bean 
public PasswordEncoder passwordEncoder(){ 
    return new BCryptPasswordEncoder(); 
} 
}

但是层次不工作。与SUPREME用户凭据请求结尾：

{ 
    "error": "access_denied", 
    "error_description": "Access is denied" 
}

当我切换到hasRole("DEVELOPER")hasRole("SUPREME") - 一切正常。

我使用Spring 1.5.2引导和Spring安全的OAuth 2.1.0.RELEASE

UPDATE

当我评论所有OAuth2.java类和移动webExpressionHandler()方法签名Security.java类 - 角色层次工作正常。那么OAuth2资源服务器发生了什么？

来源

2017-03-16 ilovkatie

您如何看待ResourceServer中的这种方法？

@Bean 
    public RoleHierarchyImpl roleHierarchy() { 
     RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl(); 
     roleHierarchy.setHierarchy("ROLE_SUPREME > ROLE_DEVELOPER ROLE_DEVELOPER > ROLE_ADMIN ROLE_ADMIN > ROLE_USER")   return roleHierarchy; 
    } 


    @Bean 
    public RoleHierarchyVoter roleVoter() { 
     return new RoleHierarchyVoter(roleHierarchy()); 
    } 


    @Bean 
    public AffirmativeBased defaultOauthDecisionManager(RoleHierarchy roleHierarchy){ // 

     List<AccessDecisionVoter> decisionVoters = new ArrayList<AccessDecisionVoter>(); 

     // webExpressionVoter 
     OAuth2WebSecurityExpressionHandler expressionHandler = new OAuth2WebSecurityExpressionHandler(); 
     expressionHandler.setRoleHierarchy(roleHierarchy); 
     WebExpressionVoter webExpressionVoter = new WebExpressionVoter(); 
     webExpressionVoter.setExpressionHandler(expressionHandler); 
     decisionVoters.add(webExpressionVoter); 
     decisionVoters.add(roleVoter()); 
     return new AffirmativeBased(decisionVoters); 
    }

而且

http 
       .authorizeRequests() 
       .accessDecisionManager(defaultOauthDecisionManager(roleHierarchy())) 
       //etc...

这可能是更好地组织和封装，但你知道我的意思，不是吗？......我认为它工作正常。我希望这会帮助你...

来源

2017-04-21 16:30:13

角色层次结构和OAuth2使用Spring Boot的安全性

回答

相关问题