我正在尝试通过使用<table_history>注释保护控制器方法来增强我的OAuth2提供程序安全性。我还添加了@PreAuthorize，因此@EnableGlobalMethodSecurity可以与oauth一起使用。
这是我目前的设置：
@PreAuthorize当我删除@Configuration
@ComponentScan
@EnableAutoConfiguration
@EnableResourceServer
@RestController
public class Application {
public static void main(String[] args) {
SpringApplication.run(Application.class, args);
}
@RequestMapping("/")
public String home() {
return "Hello World";
}
@PreAuthorize("#oauth2.clientHasRole('ROLE_CUSTOM')")
@RequestMapping("/a")
public String a() {
return "foo";
}
@PreAuthorize("#oauth2.clientHasRole('ROLE_TRUSTED_CLIENT')")
@RequestMapping("/b")
public String b() {
return "bar";
}
// So that @PreAuthorize notations would work
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public static class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
@Override
protected MethodSecurityExpressionHandler createExpressionHandler() {
return new OAuth2MethodSecurityExpressionHandler();
}
}
@Configuration
@EnableWebSecurity
public static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
}
@Configuration
@EnableAuthorizationServer
protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {
@Autowired
private AuthenticationManager authenticationManager;
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.authenticationManager(authenticationManager).tokenStore(tokenStore());
}
@Bean
public ApprovalStore approvalStore() throws Exception {
TokenApprovalStore store = new TokenApprovalStore();
store.setTokenStore(tokenStore());
return store;
}
@Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
// @formatter:off
clients.inMemory()
.withClient("my-trusted-client")
.authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
.authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
.scopes("read", "write", "trust")
.resourceIds("oauth2-resource")
.accessTokenValiditySeconds(60)
.and()
.withClient("my-client-with-registered-redirect")
.authorizedGrantTypes("authorization_code")
.authorities("ROLE_CLIENT")
.scopes("read", "trust")
.resourceIds("oauth2-resource")
.redirectUris("http://anywhere?key=value")
.and()
.withClient("my-client-with-secret")
.authorizedGrantTypes("client_credentials", "password")
.authorities("ROLE_CLIENT","ROLE_CUSTOM")
.scopes("read")
.resourceIds("oauth2-resource")
.secret("secret");
// @formatter:on
}
}
}
符号时它会起作用，但是当我添加它们时，编译器会抛出大量缺少自动装配异常的注入，而我无法确定并找到解释究竟是什么导致了这个问题。
对不起，我无法提供任何额外的输出或研究，有点卡在这一点。
答案 0 :(得分：1)
尝试从其余配置中提取@RestController类。
除了do-it-all配置类是一个很难维护的事实之外，Spring可能在配置方法安全性并在同一个类中使用它时遇到问题。