使用Oauth的Spring Security覆盖HttpSecurity

Question

我正在使用Oauth按照websystique，baeldung实现Spring Security，我发现WebSecurityConfigurerAdapter和ResourceServerConfigurerAdapter都可以控制HttpSecurity和过滤链分别按0和3添加它们。

所以我要覆盖configure中的任何一个ConfigurerAdapter，但一次只能覆盖一个。{/ p>

@Override
public void configure(HttpSecurity http) throws Exception {

     http
     .csrf().disable()
     .anonymous().disable()
     .requestMatchers().antMatchers("/api/**").and()
     .authorizeRequests()
        .antMatchers("/api/ads").permitAll()
        .antMatchers("/api/admin").hasAuthority(RoleConstant.ADMIN.getRole())
        .antMatchers("/api/user").hasAuthority(RoleConstant.USER.getRole())
        .anyRequest().authenticated()
     .and()
     .exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
}

我在WebSecurityConfigurerAdapter的情况下观察到的情况我能够访问未经授权的资源，即即使使用具有权限/api/user的令牌，我也能够在经过身份验证后访问ADMIN。为什么会这样？ / p>

注意：我没有覆盖ResourceServerConfigurerAdapter的HttpSecurity。

参考资料：这里有类似的资源。 Resource1，Resource2。

另外我想知道，我必须要覆盖configure(HttpSecurity http)或任何一个类是否足够？如果是，推荐哪一个？

ResourceServer：

@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    private static final String RESOURCE_ID = "my_rest_api";

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId(RESOURCE_ID).stateless(false);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {

         http
         .csrf().disable()
         .anonymous().disable()
         .requestMatchers().antMatchers("/api/**").and()
         .authorizeRequests()
            .antMatchers("/api/ads").permitAll()
            .antMatchers("/api/admin").hasAuthority(RoleConstant.ADMIN.getRole())
            .antMatchers("/api/user").hasAuthority(RoleConstant.USER.getRole())
            .antMatchers("/api/readProperty").access("hasRole('ADMIN')")
            .anyRequest().authenticated()
         .and()
         .exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
    }

}

SpringSecurityConfig：

@Configuration
@EnableWebSecurity
@ComponentScan(basePackages = {"com.ttnd.mvc_mod.services","com.ttnd.mvc_mod.repository","com.ttnd.mvc_mod.config","com.ttnd.mvc_mod.custom"})
@Import({SpringORMHibernateSupportConfig.class})
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private ClientDetailsService clientDetailsService;

    @Autowired
    private CustomAuthenticationProvider authProvider;

   /* @Override
    protected void configure(HttpSecurity http) throws Exception {
         http
         .csrf().disable()
         .anonymous().disable()
         .requestMatchers().antMatchers("/**").and()
         .authorizeRequests()
            .antMatchers("/oauth/token","/api/ads").permitAll()
            .antMatchers("/api/admin").hasAuthority(RoleConstant.ADMIN.getRole())
            .antMatchers("/api/user").hasAuthority(RoleConstant.USER.getRole())
            .antMatchers("/api/readProperty").access("hasRole('ADMIN')")
         .and()
         .exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());//.exceptionHandling().authenticationEntryPoint(restAuthenticationEntryPoint);

    }
    */

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //auth.userDetailsService(customUserDetailsService);
        auth.authenticationProvider(authProvider);

    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public TokenStore tokenStore() {
        return new InMemoryTokenStore();
    }

    @Bean
    @Autowired
    public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
        TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
        handler.setTokenStore(tokenStore);
        handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
        handler.setClientDetailsService(clientDetailsService);
        return handler;
    }

    @Bean
    @Autowired
    public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
        TokenApprovalStore store = new TokenApprovalStore();
        store.setTokenStore(tokenStore);
        return store;
    }

}