Question

我正在为获取授权代码编写基于表单的OAUTH身份验证。它本应该有一个授权决策页面＆＃34;资源服务器请求资源所有者对自身进行身份验证以及授权共享数据之后。

以下是服务器端配置

授权服务器

WebSecurity配置程序

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
     @Bean
        public BCryptPasswordEncoder passwordEncoder() {
            return new BCryptPasswordEncoder();
        }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().withClient("javainuse").secret("{noop}secret").authorizedGrantTypes("authorization_code")
            .scopes("read").authorities("CLIENT");
    }
}

以下是客户端配置

控制器

@Configuration
@EnableWebSecurity
public class EmployeeSecurityConfiguration extends WebSecurityConfigurerAdapter {

     @Bean
        @Override
        public AuthenticationManager authenticationManager() throws Exception {

            return super.authenticationManager();
        }

     @Autowired
     private BCryptPasswordEncoder  passwordEncoder;



    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/").permitAll().antMatchers("/user/getEmployeesList")
            .hasAnyRole("ADMIN").anyRequest().authenticated().and().formLogin()
            .permitAll().and().logout().permitAll();

        http.csrf().disable();
    }

    @Override
    public void configure(AuthenticationManagerBuilder authenticationMgr) throws Exception {
        authenticationMgr.inMemoryAuthentication().withUser("admin").password(passwordEncoder.encode("admin"))
            .authorities("ROLE_ADMIN");
    }


}

getEmployees.jsp

@Controller
public class EmployeeController {

    @RequestMapping(value = "/getEmployees", method = RequestMethod.GET)
    public ModelAndView getEmployeeInfo() {
        return new ModelAndView("getEmployees");
    }

    @RequestMapping(value = "/showEmployees", method = RequestMethod.GET)
    public String getEmployeeInfo1() {
        return "showEmployees";
    }
}

在登录提示

上提供登录详细信息后

我提供了详细信息，之后应该在http://localhost:8081/oauth/authorize

提示我

它给了我关于日志的信息

<%@taglib uri="http://www.springframework.org/tags/form" prefix="form"%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Add Employee</title>
</head>
<body>
    <h3 style="color: red;">Add New Employee</h3>

    <div id="addEmployee">
        <form:form action="http://localhost:8081/oauth/authorize"
            method="post" modelAttribute="emp">
            <p>
                <label>Enter Employee Id</label>
                 <input type="text" name="response_type" value="code" /> 
                 <input type="text" name="client_id" value="javainuse" />
                 <input type="text" name="redirect_uri" value="http://localhost:8090/showEmployees" />
                 <input type="text" name="scope" value="read" /> 
                 <input type="SUBMIT" value="Get Employee info" />
        </form:form>
    </div>
</body>
</html>

任何帮助都非常感激，不确定我在哪里做错了。我使用的是Spring Boot 2.0.2.RELEASE。

Answer 1

在输入标签中提供的redirect_uri值http://localhost:8090/showEmployees也需要在上面的Authorization Server配置中进行映射，因此

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.inMemory().withClient("javainuse").secret("secret").authorizedGrantTypes("authorization_code")
        .scopes("read").authorities("CLIENT").redirectUris("http://localhost:8090/showEmployees");
}

Answer 2

在ClientDetailsServiceConfigurer中添加重定向URL即可。

OAUTH2：授权决策页面成功登录后不会出现

2 个答案: