Question

我在/oauth/token

收到错误

InsufficientAuthenticationException：没有客户端认证。尝试添加适当的身份验证过滤器

我认为@EnableAuthorizationServer应该自动添加客户端身份验证过滤器。但我想我可能错了。

我使用authorization_code授权类型，并将client_id和client_secret发送到/oauth/token端点

@Configuration
//@PropertySource({ "classpath:persistence.properties" })
@EnableAuthorizationServer
public class OAuth2AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private Environment env;

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(final AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
      oauthServer.allowFormAuthenticationForClients(); // here
      // oauthServer.tokenKeyAccess("permitAll()")
      //   .checkTokenAccess("isAuthenticated()");
    }

    @Override
    public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {
    System.out.println("datastore -------------------------------");
        clients.jdbc(dataSource());
    }

    @Override
    public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        final TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
        tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer()));
        endpoints.tokenStore(tokenStore())
            .tokenEnhancer(tokenEnhancerChain)
            .authenticationManager(authenticationManager);
    }

    @Bean
    @Primary
    public DefaultTokenServices tokenServices() {
        final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
        defaultTokenServices.setTokenStore(tokenStore());
        defaultTokenServices.setSupportRefreshToken(false);
        return defaultTokenServices;
    }

    @Bean
    public TokenEnhancer tokenEnhancer() {
        return new CustomTokenEnhancer();
    }

    @Bean
    public DataSourceInitializer dataSourceInitializer(final DataSource dataSource) {
        final DataSourceInitializer initializer = new DataSourceInitializer();
        initializer.setDataSource(dataSource);
        // initializer.setDatabasePopulator(databasePopulator());
        return initializer;
    }

    // private DatabasePopulator databasePopulator() {
    //     final ResourceDatabasePopulator populator = new ResourceDatabasePopulator();
    //     populator.addScript(schemaScript);
    //     populator.addScript(dataScript);
    //     return populator;
    // }

    @Bean
    public DataSource dataSource() {
        final DriverManagerDataSource dataSource = new DriverManagerDataSource();

        dataSource.setDriverClassName(env.getProperty("spring.datasource.driver-class-name"));
        dataSource.setUrl(env.getProperty("spring.datasource.url"));
        dataSource.setUsername(env.getProperty("spring.datasource.username"));
        dataSource.setPassword(env.getProperty("spring.datasource.password"));

        return dataSource;
    }

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource());
    }

}

以下是我认为服务器启动时的相关日志..

21：22：37.255 [restartedMain] INFO o.s.s.w.DefaultSecurityFilterChain - 创建过滤器链：OrRequestMatcher [requestMatchers = [Ant [pattern =＆＃39; / oauth / token＆＃39;]，Ant [pattern =＆＃39; / oauth / token_key＆＃39;]，Ant [pat] 燕鸥=＆＃39; /的OAuth / check_token＆＃39;]]]， [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@5c6550ae， org.springframework.security.web.context.SecurityContextPersistenceFilter@677898f5， org.springframework.security.web.header.HeaderWriterFilter@18e1f570， org.springframework.security.web.authentication.logout.LogoutFilter@7e03993d， org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter@5070db79， org.springframework.security.web.authentication.www.BasicAuthenticationFilter@29d6f4f9， org.springframework.security.web.savedrequest.RequestCacheAwareFilter@655e2b00， org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@7c056bcc， org.springframework.security.web.authentication.AnonymousAuthenticationFilter@160d9365，有机

如何为spring security oauth2添加客户端身份验证过滤器？

0 个答案: