Question

我正在我的项目中尝试spring security和spring oauth2并将我的授权服务器和资源服务器分开。我不想在这两个服务器之间共享令牌存储，所以我决定使用RemoteTokenServices和check_token端点。一切都很好，除非我使用访问令牌查询资源服务器，我得到“401 Unauthorized”错误如下：

2015-10-19 11：50：10.291 DEBUG 2590 --- [nio-8080-exec-1] osweb.client.RestTemplate：POST请求“http://localhost:9080/uaa/oauth/check_token/”导致401（未经授权） ;调用错误处理程序 2015-10-19 11：50：10.293 DEBUG 2590 --- [nio-8080-exec-1] s.s.w.c.SecurityContextPersistenceFilter：SecurityContextHolder现已清除，请求处理完成 2015-10-19 11：50：10.293 DEBUG 2590 --- [nio-8080-exec-1] o.s.web.filter.RequestContextFilter：清除线程绑定请求上下文：org.apache.catalina.connector.RequestFacade@41f4867a 2015-10-19 11：50：10.297 ERROR 2590 --- [nio-8080-exec-1] oaccC [。[。[/]。[jerseyServlet]：servlet [jerseyServlet]的Servlet.service（）与上下文有关path []抛出异常

org.springframework.web.client.HttpClientErrorException：401未经授权在org.springframework.web.client.DefaultResponseErrorHandler.handleError（DefaultResponseErrorHandler.java:91）

授权服务器的代码：

@Configuration
@EnableAuthorizationServer
public class OAuthConfiguration extends AuthorizationServerConfigurerAdapter {
    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private DataSource dataSource;

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }

    @Bean
    protected AuthorizationCodeServices authorizationCodeServices() {
        return new JdbcAuthorizationCodeServices(dataSource);
    }

    @Bean
    public DefaultAccessTokenConverter defaultAccessTokenConverter() {
        return new DefaultAccessTokenConverter();
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(this.tokenStore())
            .authenticationManager(authenticationManager)
            .accessTokenConverter(defaultAccessTokenConverter());
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer)
            throws Exception {
        oauthServer
            .tokenKeyAccess("permitAll()")
            .checkTokenAccess("isAuthenticated()");
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.jdbc(dataSource);
    }

}

安全配置：

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.jdbcAuthentication();
//            .withUser("John").roles("ADMIN").password("password")
//            .and()
//            .withUser("Mary").roles("BASIC").password("password");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/**").authenticated()
            .and().httpBasic().realmName("OAuth Server");
        http.csrf().disable();
    }
}

资源服务器的设置如下：

@Configuration
@EnableResourceServer
public class ResourceConfiguration extends ResourceServerConfigurerAdapter {
    private static String RESOURCE_ID = "xn-resource-id"; 

    private TokenExtractor tokenExtractor = new BearerTokenExtractor();


    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId(RESOURCE_ID);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
        http.authorizeRequests().anyRequest().authenticated();
    }

    @Bean
    public AccessTokenConverter accessTokenConverter() {
        return new DefaultAccessTokenConverter();
    }

    @Bean
    public RemoteTokenServices remoteTokenServices(final @Value("${auth.server.url}") String checkTokenUrl,
            final @Value("${auth.server.client_id}") String clientId,
            final @Value("${auth.server.client_secret}") String clientSecret) {
        final RemoteTokenServices remoteTokenServices = new RemoteTokenServices();
        remoteTokenServices.setCheckTokenEndpointUrl(checkTokenUrl);
        remoteTokenServices.setClientId(clientId);
        remoteTokenServices.setClientSecret(clientSecret);
        remoteTokenServices.setAccessTokenConverter(accessTokenConverter());
        return remoteTokenServices;
    }
}

我使用curl测试了安全设置，并使用了client_credentials grant type。

有没有人帮我弄清楚上面代码的问题是什么？

Answer 1

您似乎使用了不正确的网址。尝试补充：

 http://localhost:9080/uaa/oauth/check_token

（请注意，网址未以 / 结尾）

使用RemoteTokenServices对授权服务器和资源服务器进行解耦

1 个答案: