OAuth 2 client_credentials授予类型 - 访问被拒绝

Question

我们打算同时提供两种类型的OAuth 2授权类型进行身份验证：“password”和“client_credentials”。此时“密码”授权类型运行良好，但是当我尝试使用“client_credentials”授予类型生成的访问令牌访问我的资源服务器时，我收到错误“访问被拒绝”。请给我一些提示可能导致此问题的提示。

Authserver security-context.xml：

<security:http pattern="/oauth/token" create-session="stateless"
    authentication-manager-ref="clientAuthenticationManager"
    entry-point-ref="oauthAuthenticationEntryPoint">
    <security:intercept-url pattern="/oauth/token"
        access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <security:http-basic entry-point-ref="oauthAuthenticationEntryPoint" />
    <security:custom-filter ref="clientCredentialsTokenEndpointFilter"
        before="BASIC_AUTH_FILTER" />
    <security:access-denied-handler ref="oauthAccessDeniedHandler" />
</security:http>

<context:property-placeholder location="classpath:properties/ldap-${my.env}.properties" />

<util:properties id="env">
    <prop key="username">${ldap.username}</prop>
    <prop key="password">${ldap.password}</prop>
    <prop key="url">${ldap.url}</prop>
    <prop key="root">${ldap.root}</prop>
</util:properties>

<security:ldap-server xmlns="http://www.springframework.org/schema/security"
    url="#{env['url']}" manager-dn="#{env['username']}" manager-password="#{env['password']}"
    root="#{env['root']}" />


<security:authentication-manager id="clientAuthenticationManager">
    <security:authentication-provider
        user-service-ref="clientDetailsUserService" />
</security:authentication-manager>

<bean id="clientCredentialsTokenEndpointFilter"
    class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <property name="authenticationManager" ref="clientAuthenticationManager" />
</bean>

<bean id="clientDetailsUserService"
    class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
    <constructor-arg ref="clientDetails" />
</bean>

<oauth2:authorization-server
    client-details-service-ref="clientDetails" token-services-ref="tokenServices">
    <oauth2:authorization-code />
    <oauth2:implicit />
    <oauth2:refresh-token />
    <oauth2:client-credentials />
    <oauth2:password />
</oauth2:authorization-server>

<bean id="clientDetails"
    class="org.springframework.security.oauth2.provider.JdbcClientDetailsService">
    <constructor-arg name="dataSource" ref="dataSource"></constructor-arg>
</bean>

<bean id="oauthAccessDeniedHandler"
    class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
<bean id="oauthAuthenticationEntryPoint"
    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint" />
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
    xmlns="http://www.springframework.org/schema/beans">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
            <bean class="org.springframework.security.access.vote.RoleVoter" />
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
        </list>
    </constructor-arg>
</bean>

<security:authentication-manager alias="authenticationManager">
    <security:ldap-authentication-provider
        user-search-filter="(sAMAccountName={0})" user-search-base=""
        group-search-filter="(member={0})" group-search-base="cn=Users"
        group-role-attribute="cn" role-prefix="ROLE_">
    </security:ldap-authentication-provider>
</security:authentication-manager>

<bean id="tokenStore"
    class="org.springframework.security.oauth2.provider.token.JdbcTokenStore">
    <constructor-arg name="dataSource" ref="dataSource"></constructor-arg>
</bean>

<bean id="tokenServices"
    class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <property name="tokenStore" ref="tokenStore" />
    <property name="supportRefreshToken" value="true" />
    <property name="clientDetailsService" ref="clientDetails" />
</bean>

<oauth2:expression-handler id="oauthExpressionHandler" />
<oauth2:web-expression-handler id="oauthWebExpressionHandler" />

已编辑（已解决）： 我发现了这个问题。我需要在资源应用程序中配置security-context.xml。我需要的是将accessDecisionManager的类型从“UnanimousBased”更改为“AffirmativeBased”，如下所示：

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"
    xmlns="http://www.springframework.org/schema/beans">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
            <bean class="org.springframework.security.access.vote.RoleVoter" />
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
        </list>
    </constructor-arg>
</bean>