Question

我正在尝试使用oauth2配置来保护我的网络应用程序，并且仅允许使用提供的用户凭据的受信任客户端访问该应用程序。

这是我到目前为止所拥有的

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xmlns:oauth="http://www.springframework.org/schema/security/oauth2" xmlns:sec="http://www.springframework.org/schema/security"
   xmlns:mvc="http://www.springframework.org/schema/mvc"
   xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
    http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">


    <http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
     xmlns="http://www.springframework.org/schema/security">
        <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
        <anonymous enabled="false" />
        <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
        <!-- include this only if you need to authenticate clients via request parameters -->
        <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" />
       <access-denied-handler ref="oauthAccessDeniedHandler" />
    </http>

    <!-- The OAuth2 protected resources are separated out into their own block so we can deal with authorization and error handling 
separately. This isn't mandatory, but it makes it easier to control the behaviour. -->
    <http request-matcher="regex" create-session="stateless" entry-point-ref="oauthAuthenticationEntryPoint"
      xmlns="http://www.springframework.org/schema/security">
        <!-- <anonymous enabled="false" /> -->
        <intercept-url pattern="/api/register/.*" access="ROLE_CLIENT" />
        <intercept-url pattern="/api/.*" access="ROLE_USER" />
        <access-denied-handler ref="oauthAccessDeniedHandler" />
        <expression-handler ref="oauthWebExpressionHandler" />
    </http>

    <bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
        <property name="realmName" value="qeep" />
    </bean>

    <bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
        <property name="realmName" value="qeep/client" />
    </bean>

   <bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />    

   <authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider user-service-ref="qeepUserDetailsService" />
   </authentication-manager>

   <bean id="myUserDetailsService" class="com.example.core.web.rest.auth.QeepUserDetailsService"/>

   <bean id="tokenStore" class="com.example.core.web.rest.auth.QeepTokenStore" />

   <bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
       <property name="tokenStore" ref="tokenStore" />
       <property name="supportRefreshToken" value="true" />
       <property name="clientDetailsService" ref="clientDetails" />
   </bean>

   <authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider user-service-ref="clientDetailsUserService" />
   </authentication-manager>

   <bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
       <constructor-arg ref="clientDetails" />
   </bean>

   <bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
       <property name="authenticationManager" ref="clientAuthenticationManager" />
   </bean>                

   <oauth:client-details-service id="clientDetails">
       <oauth:client client-id="my-trusted-client-with-secret" authorized-grant-types="password,authorization_code,refresh_token,implicit"
                  secret="somesecret" authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT" />
   </oauth:client-details-service>

   <oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices">
       <oauth:authorization-code />
       <oauth:implicit />
       <oauth:refresh-token />
       <oauth:client-credentials />
       <oauth:password />
   </oauth:authorization-server>

   <sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true">
       <!--you could also wire in the expression handler up at the layer of the http filters. See https://jira.springsource.org/browse/SEC-1452 -->
   <sec:expression-handler ref="oauthExpressionHandler" />
   </sec:global-method-security>

   <oauth:expression-handler id="oauthExpressionHandler" />

   <oauth:web-expression-handler id="oauthWebExpressionHandler" />
</beans>

如果我使用curl访问/oauth/token，我会收到客户端授权请求，我会使用配置的客户端凭据获得该请求。但在此/oauth/token之后才会返回404 - Not found。我在最后几个小时尝试了不同的东西而没有任何成功。

我从我使用的oauth2 1.0.5的sparklr / tonr样本中提取了配置，因为我们仍然在3.2版本。

相同的测试在sparklr-Sample-webapp中运行良好。

修改

实际的卷曲网址如下：

curl -v -H "Authorization: Basic bXktdHJ1c3RlZC1jbGllbnQtd2l0aC1zZWNyZXQ6c29tZXNlY3JldA==" "http://localhost:8084/core/oauth/token"

没有Authorization-Header我得到一个401要求配置客户端身份验证（＆＃34; my-trusted-client-secret-secret＆＃34;＆＃34; somesecret＆＃34;）但是添加了授权标题我刚收到404 - 未找到。如果我使用sparklr-Sample测试相同的内容，我会在添加上面的Basic-Auth-Header后得到一个错误，要求获得grant-type，这就是我所期望的。

我希望这会更清楚一点。

任何想法我的配置有什么问题？

Answer 1

DispatcherServlet被映射到错误的URL，我在尝试修复我先遇到的问题时将其破坏了。 Dispatcher-Servlet映射到core/api，令牌服务首先映射到core/api/oauth/token，后来我更改为core/oauth/token但我忘了更改DispatcherServlet。谢谢，戴夫的提示！

令牌URL因spring security oauth2而失败

1 个答案: