1. Add creds through url params eg.

Question

我使用Spring云安全和Oauth2来保护我的微服务。现在Pom如下：

http://maven.apache.org/xsd/maven-4.0.0.xsd"> 4.0.0

<groupId>com.oreilly.cloud</groupId>
<artifactId>spring-microservices-oauth-server</artifactId>
<version>0.0.1-SNAPSHOT</version>
<packaging>jar</packaging>

<name>spring-microservices-oauth-server</name>
<description>Demo project for Spring Boot</description>

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>1.5.7.RELEASE</version>
    <relativePath/> <!-- lookup parent from repository -->
</parent>

<properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <java.version>1.8</java.version>
    <spring-cloud.version>Dalston.SR3</spring-cloud.version>
</properties>

<dependencies>
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-oauth2</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-jdbc</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <dependency>
        <groupId>org.hsqldb</groupId>
        <artifactId>hsqldb</artifactId>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
</dependencies>

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-dependencies</artifactId>
            <version>${spring-cloud.version}</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

<repositories>
    <repository>
        <id>spring-snapshots</id>
        <name>Spring Snapshots</name>
        <url>https://repo.spring.io/snapshot</url>
        <snapshots>
            <enabled>true</enabled>
        </snapshots>
    </repository>
    <repository>
        <id>spring-milestones</id>
        <name>Spring Milestones</name>
        <url>https://repo.spring.io/milestone</url>
        <snapshots>
            <enabled>false</enabled>
        </snapshots>
    </repository>
</repositories>

Spring-boot主类如下：

package com.oreilly.cloud;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@EnableAuthorizationServer
@EnableResourceServer
@RestController
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class SpringMicroservicesOauthServerApplication {

    @RequestMapping("/resource/endpoint")
    @PreAuthorize("hasRole('ADMIN')")
    public String endpoint(){
        return "This message is protected by the resource server.";
    }

    public static void main(String[] args) {
        SpringApplication.run(SpringMicroservicesOauthServerApplication.class, args);
    }
}

授权服务器配置如下：

package com.oreilly.cloud;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;

@Configuration
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authManager;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authManager);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().withClient("webapp").secret("websecret").authorizedGrantTypes("password")
                .scopes("read,write,trust");
    }

}

请注意，身份验证管理器已自动连接到授权配置

在下面的类中验证管理器已配置并作为abean返回，以便可以自动连接到上述类：

package com.oreilly.cloud;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user1").password("password1").roles("USER").and().withUser("admin")
                .password("password2").roles("ADMIN");
    }

}

现在application.properties如下：

server.port=9090

现在我按如下方式运行Spring启动应用程序：

mvn spring-boot：run

应用程序成功启动并准备接受localhost上端口9090的请求

现在使用postman我发送一个post请求来获取access_token。一点背景是这里使用的Aoauth2流是密码授权。所以在上面的AuthorizationServerConfig类中，我定义了一个密码授权流程，并注册了一个带有客户端名称和密码的简单Web应用程序。可以看出，客户端配置在内存中。

从授权服务器获取访问令牌的post man请求如下：其post请求，具有Basic auth头标头用户名为webapp，密码为websecret。

http://localhost:9090/oauth/token?grant_type=password&username=user1&password=password1

此请求使用访问令牌json成功返回，如下所示：

{
    "access_token": "2d632e54-17c3-41f7-af3b-935ca3022d78",
    "token_type": "bearer",
    "expires_in": 43199,
    "scope": "read,write,trust"
}

现在，当我尝试使用上述访问令牌访问/ resourse / endpoint时，如下所示：

http://localhost:9090/resource/endpoint?access_token=2d632e54-17c3-41f7-af3b-935ca3022d78

不是返回从service / resourse / endpoint返回的文本，而是返回登录页面，如下所示：

<html>
    <head>
        <title>Login Page</title>
    </head>
    <body onload='document.f.username.focus();'>
        <h3>Login with Username and Password</h3>
        <form name='f' action='/login' method='POST'>
            <table>
                <tr>
                    <td>User:</td>
                    <td>
                        <input type='text' name='username' value=''>
                    </td>
                </tr>
                <tr>
                    <td>Password:</td>
                    <td>
                        <input type='password' name='password'/>
                    </td>
                </tr>
                <tr>
                    <td colspan='2'>
                        <input name="submit" type="submit" value="Login"/>
                    </td>
                </tr>
                <input name="_csrf" type="hidden" value="8dbc1c38-6f89-43c5-a8f8-797c920722a1" />
            </table>
        </form>
    </body>
</html>

任何人都可以帮助我在这里失踪的?????。

注意我在同一个应用程序中配置了授权服务器和资源服务器。这是一个POC，所以我正在尝试Spring-cloud安全性，后来我将把这两个分开......但是以后就是这样。

Answer 1

I figured out the issue by looking through Spring Boot's root debug logs.

If you're using yml:

src/main/resources/application.yml
----------------------------------
logging:
  level:
    root: DEBUG

Or if properties:

src/main/resources/application.properties
----------------------------------
logging.level.root=DEBUG

I realized I was not passing in any user auth info with the GET:

o.s.s.w.a.ExceptionTranslationFilter: Access is denied (user is anonymous); ...

So you can do 1 of 2 things:

1. Add creds through url params eg.

curl -X GET \
  'http://localhost:9090/resource/endpoint?
  username=user1&password=password1&access_token=xxxx'

or

2. Add creds through basic auth eg.

curl -X GET \
  'http://localhost:9090/resource/endpoint?username=user1' \
  -H 'Authorization: Basic xxxxxxxxxxxxx

Did you get this off the Building Microservices With Spring course on safaribooksonline, too? :)

I discovered why the teacher wasn't having the issue. He must have authorized the username/password previously -- it seems to get cached somewhere because after you GET the resource once, if you call it again with only the auth_token, it works.

确保微服务Spring云安全Oauth2

1 个答案:

1. Add creds through url params eg.

2. Add creds through basic auth eg.