Question

我正在尝试在Spring Boot应用程序中配置Spring Security OAuth2。还使用并配置了Spring Security。

首先我配置了两个框架：

  @Configuration
public class OAuth2Configuration extends AuthorizationServerConfigurerAdapter {

    private static final String RESOURCE_ID = "restservice";


    @Configuration
    @EnableResourceServer
protected static class ResourceServerConfiguration extends
        ResourceServerConfigurerAdapter {


    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources
                .resourceId(RESOURCE_ID);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http
                .requestMatcher(new OrRequestMatcher(
                        new AntPathRequestMatcher("/rest")
                ))
                .authorizeRequests()
                .anyRequest().access("#oauth2.hasScope('read')");
    }

}


@Configuration
@EnableAuthorizationServer
protected static class AuthorizationServerConfiguration extends
        AuthorizationServerConfigurerAdapter {

    private TokenStore tokenStore = new InMemoryTokenStore();

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Autowired
    UserDetailsService userDetailsService;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints)
            throws Exception {
        endpoints
                .tokenStore(this.tokenStore)
                .authenticationManager(this.authenticationManager)
                .userDetailsService(userDetailsService);

    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients
                .inMemory()
                .withClient("clientapp")
                .authorizedGrantTypes("password", "refresh_token")
                .authorities("USER")
                .scopes("read", "write")
                .resourceIds(RESOURCE_ID)
                .secret("123456");
        }


    }

}

和

 @Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
UserDetailsService userDetailsService;

@Autowired
DataSource dataSource;

@Override
public void configure(HttpSecurity http) throws Exception {

    http
            .authorizeRequests()
                .antMatchers("/user/**").authenticated()
                //.antMatchers("/rest/**").authenticated()
                .anyRequest().permitAll()
                .and()
            .formLogin()
                .loginPage("/login")
                .usernameParameter("email")
                .passwordParameter("password")
                .defaultSuccessUrl("/user/")
                .successHandler(successHandler())
                .and()
            .logout()
                .logoutUrl("/logout")
                .logoutSuccessUrl("/")
                .and()
             .rememberMe()
                 .rememberMeParameter("remember-me")
                 .tokenRepository(persistentTokenRepository())
                 .tokenValiditySeconds(86400)
                 .and()
             .csrf().disable();
}

@Bean
public AuthenticationSuccessHandler successHandler() {
    return new UserLoginSuccessHandler();
}

@Bean
public PersistentTokenRepository persistentTokenRepository() {
    JdbcTokenRepositoryImpl tokenRepositoryImpl = new JdbcTokenRepositoryImpl();
    tokenRepositoryImpl.setDataSource(dataSource);
    return tokenRepositoryImpl;
}

@Bean
public SpringSecurityDialect securityDialect() {
    return new SpringSecurityDialect();
}

@Autowired
public void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService)
        .passwordEncoder(new BCryptPasswordEncoder());
}

@Override
@Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

}

我有简单的REST方法，它接受Authenticated User，并打印电子邮件。

 @RequestMapping("/rest")
public @ResponseBody String home(@AuthenticationPrincipal User user) {
    System.out.println("USER : "+ user.getEmail());
    return "Hello "+ user.getUsername();
}

所以，我在Postman中询问/ oauth / token，我正在获取刷新令牌和访问令牌。后来我试图从/休息中获取数据。不幸的是有NullPointerException，因为用户是null。什么是重要的，错误的访问令牌未被授权（我从oauth得到了正确的错误）。我确信配置有问题，但我不知道在哪里。我从以下配置：this repository任何建议都会很好。提前谢谢你：）

使用Spring Security OAuth保护REST

0 个答案: