Question

我正在Spring进行OAuth2授权，并尝试实现authorization code授予流程。现在我有两个应用程序。客户端和授权服务器端。当我打开安全的/client/hello时，它会将我重定向到oauth2登录页面，此后将获得一个/oauth/authorize链接，但在redirect_uri中，值始终是客户端的登录页面，甚至不会更改在浏览器中手动操作。我该如何更改？如果我在身份验证服务器配置中将重定向uri更改为/client/login，它将重定向并提供授权代码，但会引发未经授权的错误。

客户

控制器：

@RestController
public class Controller {
    @GetMapping("/hello")
    public String hello() {
        return "Hello world!!";
    }

    @GetMapping("/public")
    public String publicPage() {
        return "This is public!!";
    }

    @GetMapping("/callback")
    public String login(@RequestParam("code") String code) {
        return code;
    }
}

客户端安全配置：

@Configuration
@EnableOAuth2Sso
public class ClientSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/error**", "/public**").permitAll()
                .anyRequest().authenticated();
    }
}

客户端属性：

security.oauth2.client.client-id=007314
security.oauth2.client.client-secret=MDA3MzE0
security.oauth2.client.grant-type=password
security.oauth2.client.scope=read
security.oauth2.client.pre-established-redirect-uri=http://localhost:8081/client/public
security.oauth2.client.access-token-uri=http://localhost:8082/auth/oauth/token
security.oauth2.client.user-authorization-uri=http://localhost:8082/auth/oauth/authorize
security.oauth2.client.authentication-scheme=form
security.oauth2.resource.user-info-uri=http://localhost:8081/client/hello
security.oauth2.resource.id=resource-server-rest-api

server.port=8081
server.servlet.context-path=/client

授权服务器 服务器配置：

@Configuration
@EnableAuthorizationServer
public class AuthorizationServer extends AuthorizationServerConfigurerAdapter {


    private final PasswordEncoder passwordEncoder;
    @Qualifier("authenticationManagerBean")
    private final AuthenticationManager authenticationManager;

    @Autowired
    public AuthorizationServer(PasswordEncoder passwordEncoder, AuthenticationManager authenticationManager) {
        this.passwordEncoder = passwordEncoder;
        this.authenticationManager =  authenticationManager;
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) {
        security.tokenKeyAccess("permitAll()")
                .checkTokenAccess("isAuthenticated()")
                .passwordEncoder(passwordEncoder)
                .allowFormAuthenticationForClients();
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
                .withClient("007314")
                .secret(passwordEncoder.encode("007314"))
                .authorizedGrantTypes("authorization_code", "refresh_token")
                .scopes("read")
                .resourceIds("resource-server-rest-api")
                .autoApprove(true)
                .redirectUris("http://localhost:8081/client/hello");
    }

    @Bean
    public TokenStore tokenStore(){
        return new JwtTokenStore(defaultAccessTokenConverter());
    }
    @Bean
    public JwtAccessTokenConverter defaultAccessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setSigningKey("123");
        return converter;
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
        endpoints.tokenStore(tokenStore())
                .accessTokenConverter(defaultAccessTokenConverter())
                .authenticationManager(authenticationManager);
    }
}

服务器安全性配置：

@EnableWebSecurity
@Order(1)
public class ServerSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().passwordEncoder(passwordEncoder())
                .withUser("qwerty")
                .password(passwordEncoder().encode("12345"))
                .roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/error**", "/login**", "/oauth/authorize**").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin().permitAll();
    }
}

资源服务器

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    private static final String RESOURCE_ID = "resource-server-rest-api";
    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId(RESOURCE_ID);
    }
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers(HttpMethod.GET, "/client/hello").access("#oauth2.hasScope('read')");
    }
}

服务器属性：

server.port=8082
server.servlet.context-path=/auth

Answer 1

也将：security.oauth2.client.useCurrentUri=false添加到client.properties。

Spring Oauth2重定向uri不变

1 个答案: