Question

我正在尝试使用OpenId Connect保护安全的接口。

我可以使用OIDC登录，然后大摇大摆地向我显示授权状态：

但是当我“尝试一下”时，身份验证将被忽略，并弹出一个登录框：

在我所在的班级extends SpringBootServletInitializer中，

   @Bean
   @ConditionalOnProperty("security.oauth2.client.clientId") 
    public SecurityScheme securityScheme(Environment environment, OAuth2ClientProperties clientProperties) {
        String authorizationUri = environment.getRequiredProperty("security.oauth2.client.user-authorization-uri");
        String accessTokenUri = environment.getRequiredProperty("security.oauth2.client.access-token-uri");

        LoginEndpoint loginEndpoint = new LoginEndpoint(authorizationUri);
        TokenRequestEndpoint tokenRequestEndpoint =
                new TokenRequestEndpoint(authorizationUri, clientProperties.getClientId(), clientProperties.getClientSecret());
        TokenEndpoint tokenEndpoint = new TokenEndpoint(accessTokenUri, "auth_code");
        GrantType grantType = new AuthorizationCodeGrant(tokenRequestEndpoint, tokenEndpoint);
        AuthorizationScope authorizationScope = new AuthorizationScope(authorizationScopeGlobal, authorizationScopeGlobal);
        return new OAuthBuilder()
                .name(securitySchemaOAuth2)
                .grantTypes(Arrays.asList(grantType))
                .scopes(Arrays.asList(authorizationScope))
                .build();
    }

    private List<SecurityReference> defaultAuth() {
        AuthorizationScope authorizationScope = new AuthorizationScope(authorizationScopeGlobal, authorizationScopeGlobalDesc);
        AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];
        authorizationScopes[0] = authorizationScope;
        return Arrays.asList(new SecurityReference(securitySchemaOAuth2, authorizationScopes));
    }

    @Bean
    SecurityConfiguration security(OAuth2ClientProperties clientProperties) {
        return new SecurityConfiguration(
                clientProperties.getClientId(),
                clientProperties.getClientSecret(),
                securitySchemaOAuth2,
                "test-app",
                "apiKey",
                ApiKeyVehicle.HEADER, 
                "api_key",
                " " /*scope separator*/);
    }

    @Bean
    public SecurityContext securityContext() {
        return SecurityContext.builder().securityReferences(defaultAuth()).forPaths(PathSelectors.regex("/v1/.*")).build();
    }

和具有以下内容的课程：

 @ApiModel(value = "Template", description = "Template of REST APIs")
@RestController
@RequestMapping("/v1")
public class TemplateServiceImplementation {

...

@ApiOperation(httpMethod = "GET", value = "Call Get method",
        notes = "See Get method")
@RequestMapping(method = RequestMethod.GET, value = "/calltemplate/{param}/", produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<Structure> callGet(@PathVariable("param") String param, HttpServletRequest hreq) {

    MultiValueMap<String, String> mapParams = new LinkedMultiValueMap<String, String>();
    mapParams.add("param", param);
    Structure structure = restTemplate.getForObject(callGetEndpoint, Structure.class, mapParams);

    ResponseEntity<Structure> thisresponse = new ResponseEntity<Structure>(structure, HttpStatus.OK);
    return thisresponse;
}

对不起，所有代码。那么如何使GET使用我的OIDC身份验证？

当我取消登录时，curl为： curl -X GET --header 'Accept: application/json' --header 'Authorization: Bearer eyJraWQiOiJyc2ExIiwiYWxnIjoiUlMy lots more encrypted text' 'http://localhost:8080/v1/calltemplate/%7B%20%20%20%22id%22%3A%20%22string%22%2C%20%20%20%22name%22%3A%20%22string%22%2C%20%20%20%22path%22%3A%20%22string%22%2C%20%20%20%22version%22%3A%20%22string%22%20%7D/' 要求网址： http://localhost:8080/v1/calltemplate/%7B%20%20%20%22id%22%3A%20%22string%22%2C%20%20%20%22name%22%3A%20%22string%22%2C%20%20%20%22path%22%3A%20%22string%22%2C%20%20%20%22version%22%3A%20%22string%22%20%7D/

和其他响应变量：

EDIT忘记提及我的WebSecurityConfig：

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/v2/api-docs", "/configuration/ui", 
            "/swagger-resources/**", "/configuration/**", "/swagger-ui.html"
            , "/webjars/**", "/csrf", "/");
}

更新网络输出：

为什么大摇大摆地忽略了我的身份验证？

0 个答案: