我正在尝试在我现有的应用程序中实现 Oauth2。最初我添加了 spring security 然后尝试添加 oauth2，添加配置后我能够生成 access_token 但是通过使用 access_token 我无法访问资源。

这是我的代码:

SecurityConfiguration.java

    @Configuration
    @EnableWebSecurity
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Autowired
    private ClientDetailsService clientDetailsService;

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**");
    }

    @Autowired
    public void configAuthentication(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication().dataSource(dataSource);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/", "/patients").permitAll()
                .antMatchers("/oauth/token").permitAll()
                .anyRequest().authenticated()
                .and().httpBasic();
        http.csrf().disable();
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication().dataSource(dataSource)
                .usersByUsernameQuery("select username, password, 1 as enabled from user where username=?")
                .authoritiesByUsernameQuery("select username, authority from authorities where username=?");
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public JdbcTokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }

    @Bean
    @Autowired
    public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore) {
        TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
        handler.setTokenStore(tokenStore);
        handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
        handler.setClientDetailsService(clientDetailsService);
        return handler;
    }

    @Bean
    @Autowired
    public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
        TokenApprovalStore store = new TokenApprovalStore();
        store.setTokenStore(tokenStore);
        return store;
    }
}

SecurityOAuth2Configuration.java

@Configuration
@EnableAuthorizationServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
@Import(SecurityConfiguration.class)
public class SecurityOAuth2Configuration extends AuthorizationServerConfigurerAdapter {
    private static String REALM = "CRM_REALM";
    private static final int ONE_DAY = 60 * 60 * 24;
    private static final int THIRTY_DAYS = 60 * 60 * 24 * 30;

    @Autowired
    private TokenStore tokenStore;

    @Autowired
    private DataSource dataSource;

    @Autowired
    private UserApprovalHandler userApprovalHandler;

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.realm(REALM);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.jdbc(dataSource);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
                .authenticationManager(authenticationManager);
    }
}

ResourceServer.java

@Configuration
@EnableResourceServer
public class ResourceServer extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.anonymous().disable()
                .requestMatchers().antMatchers("/patients/**").and().authorizeRequests()
                .antMatchers("/patient/**").access("hasRole('USER')")
                .and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
    }

}

我用过this引用教程。

我能够使用基本身份验证凭据获取访问 token 。

但是当我使用相同的访问 token 获取资源时，它失败了。

我已经为 oauth 添加了所有必需的表。 我有什么遗漏吗？

更新:

我删除了 .and().httpBasic(); 和 在 WebsecurityConfigurerAdapter 中添加了 @Order(3) 并使用 security.oauth2.resource.filter-order = 3

现在出现错误 { “时间戳”:1543500350487， “状态”:403， “错误”:“禁止”， “消息”:“拒绝访问”， “路径”:“/患者/1/” }

更新 2

这是我的用户和权限架构:

用户 +------------+----------------+------+-----+------ --+----------------+ |领域 |类型 |空 |键 |默认 |额外 | +------------+----------------+------+-----+------ --+----------------+ |编号 | int(6) 无符号 |否 |优先级 |空 |自动递增 | |用户名 |变量(50) |否 |大学 |空 | | |密码 |变种(100) |否 | |空 | | +------------+----------------+------+-----+------ --+----------------+

当局 +------------+----------------+-----+-----+----- ---+----------------+ |领域 |类型 |空 |键 |默认 |额外 | +------------+----------------+-----+-----+----- ---+----------------+ |编号 | int(6) 无符号 |否 |优先级 |空 |自动递增 | |用户名 |变量(50) |否 |多个 |空 | | |权威|变量(50) |否 | |空 | | +------------+----------------+-----+-----+----- ---+----------------+

最佳答案

您应该直接在您的 antmatcher 上使用 hasRole 而不是 access() 函数中的字符串。这将正确评估 hasRole 并正确确定用户有权访问所请求的资源。

这将为 ResourceServer.java 生成以下代码:

@Configuration
@EnableResourceServer
public class ResourceServer extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.anonymous().disable()
                .requestMatchers().antMatchers("/patients/**").and().authorizeRequests()
                .antMatchers("/patient/**").hasRole('USER')
                .and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
    }

}

关于java - 无法使用 access_token : spring boot Oauth2 访问资源，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/53537133/