Question

尝试使用oauth2组件保护我的回送端点时遇到问题。我使用自定义用户模型和自定义应用程序模型。这是我的oauth2选项

var options = {
      dataSource: app.dataSources.db, // Data source for oAuth2 metadata persistence
      userModel: 'LAccount',
      applicationModel: 'LOAuthClientApp',
      resourceServer: true,
      authorizationServer: true,
      //useAccessTokenModel: true,
      authorizePath: '/oauth/authorize',
      tokenPath: '/oauth/token',
      supportedGrantTypes: [
         'clientCredentials',
         'refreshToken',
         'resourceOwnerPasswordCredentials'
      ]
    };

     var oauth2 = require('loopback-component-oauth2').oAuth2Provider(
      app, // The app instance
      options // The options
    );

我正在尝试保护我的一些api端点

app.use([ '/api/mymodel/whoami', '/coordinator_noscope'], oauth2.authenticate({session: false}));
  router.get('/coordinator_noscope', function(req, res) {
    console.log(req.accessToken);
    res.json({ 'result': 'done' });
  });

这是我的“ MyModel”路线

  MyModel.remoteMethod('whoami', {
        accepts: {arg: "options", type: "object", http: "optionsFromRequest"},
        returns: { arg: 'object', type: 'object', root: true },
        http: {path: '/whoami', verb: 'get'}
  });
  MyModel.whoami = function(options, callback) {
      console.log(options.accessToken);
      callback(null, new Success('done'));
  };

当我通过客户端（带有/ oauth / authorize）获得访问令牌时，/ coordinator_noscope路由有效，但是/ api / mymodel / whoami给我一个401（AUTHORIZATION_REQUIRED）错误..

我没有在“ MyModel”模型上配置的ACL。我不明白router.get路由和Loopback api路由之间的身份验证区别是什么

环回OAuth2身份验证

0 个答案: