Question

我正在尝试创建一个支持oauth2的auth服务器，该服务器能够使用两个身份验证提供程序对用户进行身份验证：前者是内存中（默认用户密码），后者是外部LDAP服务器（现在我我正在使用gs-authenticating-ldap-complete中的示例。

我能够为任何用户成功检索访问令牌，但我只能使用刷新令牌为LDAP服务器中注册的任何用户检索新令牌。如果我尝试刷新内存中用户的令牌，一切都很好，我得到的是：401 Unauthorized { "error": "unauthorized", "error_description": "ben" }其中“ben”是用户ID。

据我所知（经过一些调试），DefaultTokenServices.java：150发生了异常。

在下面我报告我正在使用的配置类。

@Configuration
@EnableWebSecurity
@Order(6)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public TokenStore tokenStore() {
        return new InMemoryTokenStore();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated().and().csrf().disable();
    }

    @Configuration
    protected static class DefaultUsersAuthConfiguration extends GlobalAuthenticationConfigurerAdapter {

        @Override
        public void init(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication().withUser("admin").password("admin").roles("ADMIN").and().withUser("guest")
                    .password("guest").roles("USER");
        }

    }

    @Configuration
    protected static class LDAPAuthConfiguration extends GlobalAuthenticationConfigurerAdapter {

        @Override
        public void init(AuthenticationManagerBuilder auth) throws Exception {
            auth.ldapAuthentication().userDnPatterns("uid={0},ou=people").groupSearchBase("ou=groups")
                    .userDetailsContextMapper(new MyLdapUserDetailsMapper()).contextSource()
                    .ldif("classpath:test-server.ldif");
        }

    }

    protected static class MyLdapUserDetailsMapper extends LdapUserDetailsMapper {

        @Override
        public UserDetails mapUserFromContext(DirContextOperations ctx, String username,
                Collection<? extends GrantedAuthority> authorities) {
            final UserDetails originalUser = super.mapUserFromContext(ctx, username, authorities);

            final Set<GrantedAuthority> newAuth = new HashSet<>(originalUser.getAuthorities());
            newAuth.add(new SimpleGrantedAuthority("ROLE_EXTRA_ROLE"));

            return new User(originalUser.getUsername(), originalUser.getPassword(), originalUser.isEnabled(),
                    originalUser.isAccountNonExpired(), originalUser.isCredentialsNonExpired(),
                    originalUser.isAccountNonLocked(), newAuth);
        }

    }

}

@Configuration
@EnableAuthorizationServer
public class OAuth2Config extends OAuth2AuthorizationServerConfiguration {

    @Autowired
    private TokenStore tokenStore;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().withClient("acme").secret("acmesecret")
                .authorizedGrantTypes("password", "refresh_token", "client_credentials")
                .scopes("read", "write", "openid").autoApprove(true);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.tokenStore(tokenStore);
    }

    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

        @Autowired
        private TokenStore tokenStore;

        @Override
        public void configure(HttpSecurity http) throws Exception {
            // @formatter:off
            http.authorizeRequests().antMatchers("/me").authenticated();
            // @formatter:on
        }

        @Override
        public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
            resources.tokenStore(tokenStore);
        }
    }

}

我正在使用spring-boot 1.3.2.RELEASE。我错过了什么？

无法使用多个身份验证提供程序刷新spring oauth2令牌

0 个答案: