以毫秒为单位

Question

我在授权服务上使用密码授权和JWT设置了Spring OAuth 2.0，它连接到用户详细信息的MongoDB数据存储。我有一个具有相同用户详细信息的单独服务，但是当Spring尝试验证JWT令牌时，我总是得到无效令牌。令牌是有效的，因为我使用/ oauth / check_token端点检查它并且它成功返回。我不确定问题是什么，也许是我的配置或代码。以下是我不断得到的错误以及我的代码和配置。请提供帮助。

{
  "error": "invalid_token",
  "error_description": "Invalid access token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiNTdhMjcyYzIwMzNlZmUxMWVhNTU0ZjdkIiwidXNlcl9uYW1lIjoic3Ryb21lcm8zMjEiLCJzY29wZSI6WyJyZWFkIl0sImV4cCI6MTQ3Mzk5MzQzMCwiYXV0aG9yaXRpZXMiOlsiVVNFUiJdLCJqdGkiOiJiMTJkMTU2Yy1iNTlhLTQ1N2MtOWRhNi1jMGU4NDM2ZmFhZTMiLCJlbWFpbCI6InN0cm9tZXJvMzIxQGRlbGlvdHRlLmNvbSIsImNsaWVudF9pZCI6InRhZ3hsZS11bml0eSJ9.Ic3mLUpOQcHLlyQhVUrE0vZ6nmQyX7Y6yQ9uWP3A7ZY"
}

错误的堆栈跟踪：

 2016-09-15 21:28:48,137 [http-nio-9191-exec-3] ERROR - API_ERROR class com.tagxle.core.web.error.ExceptionHandlingController: Exception thrown: Missing request header 'Authorization' for method parameter of type Stringorg.springframework.web.bind.ServletRequestBindingException: Missing request header 'Authorization' for method parameter of type String  at org.springframework.web.method.annotation.RequestHeaderMethodArgumentResolver.handleMissingValue(RequestHeaderMethodArgumentResolver.java:82)    at org.springframework.web.method.annotation.AbstractNamedValueMethodArgumentResolver.handleMissingValue(AbstractNamedValueMethodArgumentResolver.java:208)     at org.springframework.web.method.annotation.AbstractNamedValueMethodArgumentResolver.resolveArgument(AbstractNamedValueMethodArgumentResolver.java:104)    at org.springframework.web.method.support.HandlerMethodArgumentResolverComposite.resolveArgument(HandlerMethodArgumentResolverComposite.java:121)   at org.springframework.web.method.support.InvocableHandlerMethod.getMethodArgumentValues(InvocableHandlerMethod.java:161)   at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:128)  at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:114)  at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827)    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738)     at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)     at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963)     at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:897)  at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)   at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)   at javax.servlet.http.HttpServlet.service(HttpServlet.java:648)     at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)  at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.springframework.boot.web.filter.ApplicationContextHeaderFilter.doFilterInternal(ApplicationContextHeaderFilter.java:55)  at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.springframework.cloud.sleuth.instrument.web.TraceFilter.doFilter(TraceFilter.java:156)   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.springframework.boot.actuate.trace.WebRequestTraceFilter.doFilterInternal(WebRequestTraceFilter.java:105)    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317)     at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)   at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:115)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)   at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169)   at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter(OAuth2AuthenticationProcessingFilter.java:176)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:121)  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)  at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)   at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)     at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)  at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)   at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:87)   at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77)   at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:107)    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)  at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:108)  at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:522)   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349)  at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:1110)  at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)     at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:785)  at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1425)  at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)  at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)   at java.lang.Thread.run(Thread.java:745)

我的授权服务器和用户详细信息：

clientId：XXXXXX clientSecret：XXXXX jwtSigningKey：XXXXXX

以毫秒为单位

accessTokenValiditySeconds：3600 refreshTokenValiditySeconds：2592000

AuthorizationServerConfiguration类

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;
    @Autowired
    private UserDetailsService userDetailsService;

    @Value("${clientId}")
    private String clientId;

    @Value("${clientSecret}")
    private String clientSecret;

    @Value("${jwtSigningKey}")
    private String jwtSigningKey;

    @Value("${accessTokenValiditySeconds}")
    private String accessTokenValiditySeconds;

    @Value("${refreshTokenValiditySeconds}")
    private String refreshTokenValiditySeconds;

    @Bean
    public JwtAccessTokenConverter accessTokenConverter(){
        JwtAccessTokenConverter accessTokenConverter = new JwtAccessTokenConverter();
        accessTokenConverter.setSigningKey(jwtSigningKey);
        return accessTokenConverter;
    }

    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(accessTokenConverter());
    }

    @Bean
    public TokenEnhancer tokenEnhancer() {
        return new JWTTokenEnhancer();
    }

    // Added for refresh token capability
    @Bean
    @Primary
    public DefaultTokenServices tokenServices(){
        final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
        defaultTokenServices.setTokenStore(tokenStore());
        defaultTokenServices.setSupportRefreshToken(true);
        return defaultTokenServices;
    }

    @Override
    public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()
                    .withClient(clientId)
                    .secret(clientSecret)
                    .authorizedGrantTypes("password", "refresh_token")
                    .scopes("read","write")
                    .accessTokenValiditySeconds(Integer.valueOf(accessTokenValiditySeconds)) // 1 hour
                    .refreshTokenValiditySeconds(Integer.valueOf(refreshTokenValiditySeconds));// 30 days
    }

    @Override
    public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

        // Add the JWT token enhancer to the token enhancer chain then add to endpoints
        TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
        tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer(), accessTokenConverter()));

        endpoints.tokenStore(tokenStore())
                .tokenEnhancer(tokenEnhancerChain)
                .authenticationManager(authenticationManager)
                .userDetailsService(userDetailsService)
                .allowedTokenEndpointRequestMethods(HttpMethod.GET,HttpMethod.POST)
                .accessTokenConverter(accessTokenConverter());
    }

    @Override
    public void configure(final AuthorizationServerSecurityConfigurer securityConfigurer) throws Exception {
        securityConfigurer.checkTokenAccess("permitAll()");
        super.configure(securityConfigurer);
    }
}

JWTTokenEnhancer类

public class JWTTokenEnhancer implements TokenEnhancer {

    @Override
    public OAuth2AccessToken enhance(final OAuth2AccessToken accessToken,
                                     final OAuth2Authentication authentication) {

        Map<String, Object> additionalInfo = new HashMap<>();

        // Get the user detail implementation
        UserDetailsImpl userDetails = (UserDetailsImpl) authentication.getPrincipal();

        // add userId and roles to the JWT token
        additionalInfo.put("user_id", userDetails.getUserId());
        additionalInfo.put("email", userDetails.getEmail());
        additionalInfo.put("user_name", userDetails.getUsername());
        ((DefaultOAuth2AccessToken) accessToken).setAdditionalInformation(additionalInfo);

        return accessToken;
    }
}

UserDetailsImpl类

public class UserDetailsImpl implements UserDetails {

    private static final long serialVersionUID = 3185970362329652822L;

    private User user;

    public UserDetailsImpl(final User user){
        this.user = user;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {

        Collection<GrantedAuthority> authorities = new HashSet<>();
        Set<Role> roles = user.getRoles();
        authorities.addAll(roles.stream()
                .map(role -> new SimpleGrantedAuthority(role.getRole()))
                .collect(Collectors.toList()));

        return authorities;
    }

    public Set<Role> getUserRoles() {
        return user.getRoles();
    }

    public String getUserId() {
        return user.getId();
    }

    public String getEmail() {
        return user.getEmail();
    }

    @Override
    public String getPassword() {
        return user.getPassword();
    }

    @Override
    public String getUsername() {
        return user.getUserName();
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }

}

UserServiceImpl类

@Service
public class UserServiceImpl  implements UserService, UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public User findByUserName(final String userName) {
        return userRepository.findByUserName(userName);
    }

    @Override
    public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException {
        User user = findByUserName(username);
        if( user == null ){
            throw new UsernameNotFoundException(username);
        }

        return new UserDetailsImpl(user);
    }

}

角色类

@Document
public class Role {

    private String role;

    public String getRole() {
        return role;
    }

    public void setRole(String role) {
        this.role = role;
    }

    @Override
    public boolean equals(Object o) {
        return EqualsBuilder.reflectionEquals(this,o,false);

    }

    @Override
    public int hashCode() {
        return HashCodeBuilder.reflectionHashCode(this,false);
    }

    @Override
    public String toString() {
        return ToStringBuilder.reflectionToString(this);
    }
}

用户类

@Document
public class User {

    @Id
    private String id;
    private String email;
    private String password;
    @Indexed(unique=true, direction= IndexDirection.DESCENDING, dropDups=true)
    private String userName;
    private Set<Role> roles;
    @JsonFormat(shape = JsonFormat.Shape.STRING, pattern = "dd-MM-yyyy hh:mm:ss")
    private LocalDateTime created;
    @JsonFormat(shape = JsonFormat.Shape.STRING, pattern = "dd-MM-yyyy hh:mm:ss")
    private LocalDateTime modified;

    public LocalDateTime getCreated() {
        return created;
    }

    public void setCreated(LocalDateTime created) {
        this.created = created;
    }

    public LocalDateTime getModified() {
        return modified;
    }

    public void setModified(LocalDateTime modified) {
        this.modified = modified;
    }

    public String getId() {
        return id;
    }

    public void setId(String id) {
        this.id = id;
    }

    public String getEmail() {
        return email;
    }

    public void setEmail(String email) {
        this.email = email;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public String getUserName() {
        return userName;
    }

    public void setUserName(String userName) {
        this.userName = userName;
    }

    public Set<Role> getRoles() {
        return roles;
    }

    public void setRoles(Set<Role> roles) {
        this.roles = roles;
    }

    @Override
    public boolean equals(Object o) {
        return EqualsBuilder.reflectionEquals(this,o,false);

    }

    @Override
    public int hashCode() {
        return HashCodeBuilder.reflectionHashCode(this,false);
    }

    @Override
    public String toString() {
        return ToStringBuilder.reflectionToString(this);
    }
}

UserRepository类

@Repository
public interface UserRepository extends MongoRepository<User, String> {

    User findByUserName(String userName);
}

我的资源服务器：

@Configuration
@EnableResourceServer
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled=true, prePostEnabled=true)
@ComponentScan("com.tagxle.core.web.security")
public class ResourceServerConfiguration
        extends ResourceServerConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;
    @Autowired
    private PasswordEncoder passwordEncoder;

    // Global Security Concerns
    @Bean
    public AuthenticationProvider authProvider() {
        final DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder);
        return authProvider;
    }

    @Autowired
    public void configureGlobal(final AuthenticationManagerBuilder auth) {
        auth.authenticationProvider(authProvider());
    }

    // http security concerns
    @Override
    public void configure(final HttpSecurity http) throws Exception {

        http.authorizeRequests()
                .antMatchers("/swagger-ui.html").permitAll()
                .antMatchers("/api/management/**").permitAll()
                .antMatchers(HttpMethod.POST, "/api/users/**").permitAll()
                .antMatchers("/api/**").authenticated().and().
                sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().csrf().disable();
    }
}

使用Spring OAuth 2.0密码授予与JWT时无效的访问令牌

以毫秒为单位

0 个答案: