在请求访问令牌OAuth2 Spring实现时获得500 http错误

时间：2014-10-20 07:54:49

标签： spring spring-mvc spring-security spring-security-oauth2

这是问题Problems redirecting to access token entry point Oauth Token的序列。

我已经帮助修复了其中的一部分但是我现在在获取/ oauth / token时遇到授权/权限错误。我正在使用Spring 4.0.5.RELEASE，Spring-Security 3.2.5.RELEASE和现在的Spring-Oauth2 2.0.4-build代替2.0.3.RELEASE。

错误如下，我怀疑输入点安全性或oauth2：authorization-server出现了问题。

HTTP Status 500 - Request processing failed; nested exception is error="access_denied", error_description="Error requesting access token."

org.springframework.web.util.NestedServletException: Request processing failed; nested exception is error="access_denied", error_description="Error requesting access token."
    org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:973)
    org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:852)
    javax.servlet.http.HttpServlet.service(HttpServlet.java:618)
    org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:837)
    javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
    org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
    org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:118)
    org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:84)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.oauth2.client.filter.OAuth2ClientContextFilter.doFilter(OAuth2ClientContextFilter.java:57)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:154)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:199)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:85)
    org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
    org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344)
    org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261)
    org.apache.logging.log4j.core.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:66)

这是我的授权服务器设置：

<oauth2:authorization-server client-details-service-ref="webServiceClientService" 
    token-services-ref="tokenServices" user-approval-page="/oauth/userapproval" 
    error-page="/oauth/error" authorization-endpoint-url="/oauth/authorize" 
    token-endpoint-url="/oauth/token" user-approval-handler-ref="userApprovalHandler" 
    redirect-resolver-ref="resolver">
    <oauth2:authorization-code
        authorization-code-services-ref="codes" />
    <oauth2:implicit/>
    <oauth2:refresh-token/>
    <oauth2:client-credentials/>
    <oauth2:password authentication-manager-ref="userAuthenticationManager"/>
</oauth2:authorization-server>

我的userAuthenticationManager用于输入密码：

<sec:authentication-manager alias="userAuthenticationManager"> 
<sec:authentication-provider user-service-ref="userService"> 
<sec:password-encoder ref="passwordEncoder"/> 
</sec:authentication-provider> 
</sec:authentication-manager>

其中userService是UserDetailsS​​ervice的实现。

对于pattern =“/ oauth / token”我有access =“hasAuthority（'OAUTH_CLIENT'）”我已经在用户角色上定义了。我也有for session create-session =“stateless”和我的身份验证-manager-REF = “oauthClientAuthenticationManager”。 oauthClientAuthenticationManager具有身份验证提供者user-service-ref =“clientDetailsUserService”，这是UserDetailsS​​ervice实现。我有入口点-ref =“oauthAuthenticationEntryPoint”，即org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoin t和不改变领域或TypeName。

我也有。 clientAuthenticationEntryPoint也是一个OAuth2AuthenticationEntryPoint，但我将typeName设置为Basic，而Realm则维护默认的oauth。

我也设置了

<sec:custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" /><sec:access-denied-handler ref="oauthAccessDeniedHandler" /> 
<sec:expression-handler ref="webSecurityExpressionHandler" />

其中clientCredentialsTokenEndpointFilter是org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpoi ntFilter，其中oauthClientAuthenticationManager作为身份验证管理器。

<sec:authentication-manager id="oauthClientAuthenticationManager"> 
<sec:authentication-provider user-serviceref="clientDetailsUserService"> </sec:authentication-provider> 
</sec:authentication-manager>

我也有

<sec:access-denied-handler ref="oauthAccessDeniedHandler" /> 
<sec:expression-handler ref="webSecurityExpressionHandler" />

oauthAccessDeniedHandler = org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler。 webSecurityExpressionHandler = org.springframework.security.oauth2.provider.expression.OAuth2WebSecurityExpress ionHandler

我的切入点如下：

<sec:http use-expressions="true" create-session="stateless"
    authentication-manager-ref="oauthClientAuthenticationManager"
    entry-point-ref="oauthAuthenticationEntryPoint" pattern="/oauth/token">
    <sec:intercept-url pattern="/oauth/token" access="hasAuthority('OAUTH_CLIENT')" />
    <!-- <sec:intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /> -->
    <!-- <sec:http-basic entry-point-ref="oauthAuthenticationEntryPoint"/> -->
    <sec:http-basic entry-point-ref="clientAuthenticationEntryPoint"/>
    <!-- <sec:http-basic/> -->
    <sec:anonymous enabled="false" />
    <sec:custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" />
    <sec:access-denied-handler ref="oauthAccessDeniedHandler" />
    <sec:expression-handler ref="webSecurityExpressionHandler" />
    <!-- <sec:custom-filter ref="corsFilter" after="LAST"/> -->
</sec:http>

clientCredentialsTokenEndpointFilter定义为：

<beans:bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <beans:property name="authenticationManager" ref="oauthClientAuthenticationManager"/>
</beans:bean>

和

<sec:authentication-manager id="oauthClientAuthenticationManager">
    <sec:authentication-provider user-service-ref="clientDetailsUserService">
    </sec:authentication-provider>
</sec:authentication-manager>

<beans:bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
        <beans:constructor-arg ref="webServiceClientService" />
    </beans:bean>

有什么建议吗？感谢。

1 个答案:

答案 0 :(得分：0)

我怀疑你的Spring版本是Spring 4.0.5.RELEASE，Spring-Security 3.2.5.RELEASE。检查Spring 4.0.5适用于Spring-Security 3.2.5。我认为你应该将你的Spring 4.0.5降级到3.xx.xx。

相关问题
最新问题