Question

在我的spring-boot应用程序中，我尝试将OAuth2与JWT一起使用。但是当我登录时，我只获得AnonymousAuthenticationToken而不是经过身份验证的用户。

这是我的OAuth2配置

public class OAuth2ServerConfiguration {

private static final String RESOURCE_ID = "restservice";


@Bean
public JwtAccessTokenConverter getTokenConverter() {
    JwtAccessTokenConverter tokenConverter = new JwtAccessTokenConverter();
    // for asymmetric signing/verification use tokenConverter.setKeyPair(...);
    tokenConverter.setSigningKey("aTokenSigningKey");
    tokenConverter.setVerifierKey("aTokenSigningKey");
    return tokenConverter;
}

@Bean
@Autowired
public JwtTokenStore getTokenStore(JwtAccessTokenConverter tokenConverter) {
    return new JwtTokenStore(tokenConverter);
}

@Configuration
@EnableResourceServer
protected static class ResourceServerConfiguration extends
        ResourceServerConfigurerAdapter {

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        // @formatter:off
        resources
                .resourceId(RESOURCE_ID);
        // @formatter:on
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        // @formatter:off

        http.authorizeRequests()
                .antMatchers("/register/**")
                .permitAll()
                .antMatchers("/user/**")
                .access("#oauth2.hasScope('read')");


        // @formatter:on
    }

}

@Configuration
@EnableAuthorizationServer
protected static class AuthorizationServerConfiguration extends
        AuthorizationServerConfigurerAdapter {

    @Autowired
    JwtAccessTokenConverter tokenConverter;

    @Autowired
    JwtTokenStore tokenStore;


    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Autowired
    private CustomUserDetailsService userDetailsService;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints)
            throws Exception {
        // @formatter:off
        endpoints
                .tokenStore(this.tokenStore)
                .tokenEnhancer(this.tokenConverter)
                .authenticationManager(this.authenticationManager)
                .userDetailsService(userDetailsService);
        // @formatter:on
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        // @formatter:off
        clients
                .inMemory()
                .withClient("aClient")
                .authorizedGrantTypes("password", "refresh_token")
                .authorities("USER")
                .scopes("read", "write")
                .resourceIds(RESOURCE_ID)
                .secret("aSecret");
        // @formatter:on
    }

    @Bean
    @Primary
    public DefaultTokenServices tokenServices() {
        DefaultTokenServices tokenServices = new DefaultTokenServices();
        tokenServices.setSupportRefreshToken(true);
        tokenServices.setTokenStore(this.tokenStore);
        tokenServices.setTokenEnhancer(this.tokenConverter);
        return tokenServices;
    }
}
}

这是我的WebSecurityConfiguration：

public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

@Autowired
private CustomUserDetailsService userDetailsService;

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService);
}

@Override
protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable();
}


@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}
}

这是我的登录代码：

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    User aUser = UserRepository.fakeUserRepository.get(auth.getName());

但即使我提供了正确的凭据，auth也是AnonymousAuthenticationToken。有人能告诉我缺少什么吗？

spring-boot JWT OAuth2 AnonymousAuthenticationToken

0 个答案: