Spring oauth2指定受保护和不受保护的资源

Question

我在我的Spring MVC Web应用程序中实现了oauth2。现在我受到保护，并且不受保护的资源（如我的所有Web服务和帐户）（用于密码重置，电子邮件验证等）。即使我指定帐户完全访问，我当前的弹簧安全性仍会阻止具有访问令牌的所有请求。有人能够纠正如何定义受保护和不受保护的资源。

Web配置

<!-- Spring Root --> 
<context-param> 
    <param-name>contextClass</param-name> 
    <param-value> 
     org.springframework.web.context.support.AnnotationConfigWebApplicationContext 
    </param-value> 
</context-param> 
<context-param> 
    <param-name>contextConfigLocation</param-name> 
    <param-value>portal</param-value> 
</context-param> 
<listener> 
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> 
</listener> 

<servlet> 
    <servlet-name>SpringDispatcher</servlet-name> 
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> 
    <init-param> 
     <param-name>contextClass</param-name> 
     <param-value> 
      org.springframework.web.context.support.AnnotationConfigWebApplicationContext 
     </param-value> 
    </init-param> 
    <!-- <init-param> <param-name>contextConfigLocation</param-name> <param-value>portal</param-value> 
     Modify this one to get clean URL without portal by plain "/" </init-param> --> 
    <load-on-startup>1</load-on-startup> 
</servlet> 

<servlet-mapping> 
    <servlet-name>SpringDispatcher</servlet-name> 
    <url-pattern>/</url-pattern> 
</servlet-mapping> 

<!-- Spring Security --> 
<filter> 
    <filter-name>springSecurityFilterChain</filter-name> 
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 
</filter> 
<filter-mapping> 
    <filter-name>springSecurityFilterChain</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 

的oauth2 Web安全

<!-- Definition of the Authentication Service --> 
    <http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager" 
    xmlns="http://www.springframework.org/schema/security"> 
     <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/> 
     <anonymous enabled="false"/> 
     <http-basic entry-point-ref="clientAuthenticationEntryPoint"/> 
     <!-- include this only if you need to authenticate clients via request parameters --> 
     <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/> 
      <access-denied-handler ref="oauthAccessDeniedHandler"/> 
    </http> 

    <http pattern="/Accounts" create-session="stateless" authentication-manager-ref="clientAuthenticationManager" 
    xmlns="http://www.springframework.org/schema/security"> 
      <intercept-url pattern="/Accounts" access="IS_AUTHENTICATED_FULLY"/> 
      <anonymous enabled="true"/> 
      <http-basic entry-point-ref="clientAuthenticationEntryPoint"/> 
      <!-- include this only if you need to authenticate clients via request parameters --> 
      <!-- <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/> 
      <access-denied-handler ref="oauthAccessDeniedHandler"/> --> 
    </http> 

    <!-- Protected resources --> 
    <http pattern="/**" 
    create-session="never" 
    entry-point-ref="oauthAuthenticationEntryPoint" 
    access-decision-manager-ref="accessDecisionManager" 
    xmlns="http://www.springframework.org/schema/security"> 
      <anonymous enabled="false"/> 
      <intercept-url pattern="/**" 
       access="ROLE_USER"/> 
      <custom-filter ref="resourceServerFilter" 
       before="PRE_AUTH_FILTER"/> 
      <access-denied-handler 
     ref="oauthAccessDeniedHandler"/> 
</http> 

Answer 1

我固定它通过添加/ API/ControllerName我所有的请求映射和修改受保护的资源/ API/**

@Controller 
@RequestMapping(value = "/API/ProductManagement") 
public class ProductManagementController extends BaseController { 
    //Implementation 
} 

oAuth2网络安全

<http pattern="/Accounts" create-session="stateless" authentication-manager-ref="clientAuthenticationManager" 
    xmlns="http://www.springframework.org/schema/security"> 
     <intercept-url pattern="/Accounts" access="IS_AUTHENTICATED_FULLY"/> 
     <anonymous enabled="false"/> 
     <http-basic entry-point-ref="clientAuthenticationEntryPoint"/> 
     <!-- include this only if you need to authenticate clients via request parameters --> 
     <!-- <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/> 
     <access-denied-handler ref="oauthAccessDeniedHandler"/> --> 
</http> 

<!-- Protected resources --> 
<http pattern="/API/**" 
    create-session="never" 
    entry-point-ref="oauthAuthenticationEntryPoint" 
    access-decision-manager-ref="accessDecisionManager" 
    xmlns="http://www.springframework.org/schema/security"> 
     <anonymous enabled="false"/> 
     <intercept-url pattern="/**" 
       access="ROLE_USER"/> 
     <custom-filter ref="resourceServerFilter" 
       before="PRE_AUTH_FILTER"/> 
     <access-denied-handler 
     ref="oauthAccessDeniedHandler"/> 
</http>