如何使用access_token从命令行访问受保护的spring引导资源，例如卷曲或httpie

Question

在我们的春季启动应用程序中，我们使用mitreid进行openid连接。如果我们从浏览器访问受保护的资源，我们将被重定向到我们的openid提供程序keycloak，然后在成功进行身份验证后，将其重定向到所需的资源。这是按照预期的方式工作。

现在我们想从命令行访问相同的资源，例如curl或httpie。

但没有任何效果。

从keycloak获取access_token会返回一个带有access_token和id_token的jwt。

但是使用curl -H访问“授权：承载'access_token＆gt;'”http://localhost:8080不起作用。

这是我的oidc配置

public class OIDCSecurityConfiguration extends WebSecurityConfigurerAdapter {
public static final Logger LOG = LoggerFactory.getLogger(OIDCSecurityConfiguration.class);
private final String loginPath = OIDCAuthenticationFilter.FILTER_PROCESSES_URL;

@Value("${oidc.issuer-uri}")
private String issuerUri;

@Value("${oidc.client-uri}")
private String clientUri;

@Value("${oidc.client-id}")
private String clientId;

@Value("${oidc.client-secret}")
private String clientSecret;

@Value("${oidc.client-scopes}")
private String clientScopes;

private String getLogoutUri() {
    final ServerConfiguration serverConfiguration = serverConfigurationService().getServerConfiguration(issuerUri);
    if (serverConfiguration == null) {
        LOG.error("OpenID Connect server configuration could not be retrieved");
        return "/";
    }
    try {
        return serverConfiguration.getEndSessionEndpoint() + "?redirect_uri=" + URLEncoder.encode(clientUri, "UTF-8");
    } catch (UnsupportedEncodingException e) {
        LOG.error("Cannot encode redirect uri");
        return "/";
    }
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .addFilterBefore(authenticationFilter(), AbstractPreAuthenticatedProcessingFilter.class)
            .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
            .and()
            .authorizeRequests()
            .antMatchers("/logout").permitAll()
            .and()
            .formLogin().loginPage("/openid_connect_login")
            .and()
            .logout().logoutSuccessUrl(getLogoutUri());
}

@Autowired
public void configureAuthenticationProvider(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authenticationProvider());
}

@Bean
public AuthenticationEntryPoint authenticationEntryPoint() {
    return new LoginUrlAuthenticationEntryPoint(loginPath);
}

@Bean
public WebMvcConfigurerAdapter mvcInterceptor() {
    return new UserInfoInterceptorAdapter();
}

@Bean
public AuthenticationProvider authenticationProvider() {
    final OIDCExtendedAuthenticationProvider authenticationProvider = new OIDCExtendedAuthenticationProvider();
    authenticationProvider.setAuthoritiesMapper(new KeycloakAuthoritiesMapper(clientId));
    return authenticationProvider;
}

@Bean
public AbstractAuthenticationProcessingFilter authenticationFilter() throws Exception {
    final OIDCAuthenticationFilter filter = new OIDCAuthenticationFilter();

    filter.setAuthenticationManager(authenticationManager());
    filter.setServerConfigurationService(serverConfigurationService());
    filter.setClientConfigurationService(clientConfigurationService());

    final StaticSingleIssuerService issuer = new StaticSingleIssuerService();
    issuer.setIssuer(this.issuerUri);

    filter.setIssuerService(issuer);
    // TODO: change to signed or encrypted builder for production.
    filter.setAuthRequestUrlBuilder(new PlainAuthRequestUrlBuilder());
    return filter;
}

@Bean
public ClientConfigurationService clientConfigurationService() {
    final StaticClientConfigurationService service = new StaticClientConfigurationService();
    final RegisteredClient client = new RegisteredClient();
    client.setClientId(clientId);
    client.setClientSecret(clientSecret);
    client.setClientName(clientId);
    client.setScope(Arrays.stream(clientScopes.split(",")).collect(Collectors.toSet()));
    client.setTokenEndpointAuthMethod(AuthMethod.SECRET_BASIC);
    client.setRedirectUris(Collections.singleton(clientUri + loginPath));
    client.setRequestObjectSigningAlg(JWSAlgorithm.RS256);
    service.setClients(Collections.singletonMap(this.issuerUri, client));
    return service;
}

@Bean
public ServerConfigurationService serverConfigurationService() {
    final DynamicServerConfigurationService service = new DynamicServerConfigurationService();
    service.setWhitelist(Collections.singleton(issuerUri));
    return service;
}

private static class UserInfoInterceptorAdapter extends WebMvcConfigurerAdapter {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new UserInfoInterceptor());
    }
}

}