Question

我是学生，正在做关于春季安全性oauth2的事情。但是当我运行客户端时，在输入用户名，密码和审批权限后，它在我的控制台中显示错误：“访问令牌提供者返回了空访问令牌，根据合同，这是非法的”。我已经将其修复了1周，但没有成功。有人能帮我吗？下面是服务器和客户端的代码。

这是github中的源代码：服务器：https://github.com/Akourtiim/oauth2-spring-boot-2.0.2 客户：https://github.com/RoHanh96/Oauth2_SSO/tree/master/spring-security-client。

感谢您的阅读。

授权服务器配置：

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends 
AuthorizationServerConfigurerAdapter {
@Bean
@ConfigurationProperties(prefix = "spring.datasource")
public DataSource oauthDataSource() {
    return DataSourceBuilder.create().build();
}

@Bean
public JdbcClientDetailsService clientDetailsService() {
    return new JdbcClientDetailsService(oauthDataSource());
}

@Bean
public TokenStore tokenStore() {
    return new JdbcTokenStore(oauthDataSource());
}

@Bean
public ApprovalStore approvalStore() {
    return new JdbcApprovalStore(oauthDataSource());
}

@Bean
public AuthorizationCodeServices authorizationCodeServices() {
    return new JdbcAuthorizationCodeServices(oauthDataSource());
}

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.withClientDetails(clientDetailsService());
}

@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
    oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
}

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    final TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
    tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer()));
    endpoints
            .approvalStore(approvalStore())
            .authorizationCodeServices(authorizationCodeServices())
            .tokenStore(tokenStore()).tokenEnhancer(tokenEnhancerChain);
}

@Bean
public TokenEnhancer tokenEnhancer() {
    return new CustomTokenEnhancer();
}
}

CustomTokenEnhancer.java：

    public class CustomTokenEnhancer implements TokenEnhancer {

    @Override
    public OAuth2AccessToken enhance(OAuth2AccessToken accessToken, OAuth2Authentication authentication) {
        final Map<String, Object> additionalInfo = new HashMap<>();
        additionalInfo.put("organization", authentication.getName() + randomAlphabetic(4));
        ((DefaultOAuth2AccessToken) accessToken).setAdditionalInformation(additionalInfo);
        return accessToken;
    }
}

WebSecurityConfiguration.java（身份验证服务器）

@EnableWebSecurity
@Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {


@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

@Bean
@Override
public UserDetailsService userDetailsServiceBean() throws Exception {
    return new JdbcUserDetails();
}

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/webjars/**","/resources/**");

}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .antMatchers("/login","/logout.do").permitAll()
            .antMatchers("/**").authenticated()
            .and()
            .formLogin()
            .loginProcessingUrl("/login.do")
            .usernameParameter("username")
            .passwordParameter("password")
            .loginPage("/login")
            .and()
            .logout()
            .logoutRequestMatcher(new AntPathRequestMatcher("/logout.do"))
            .and()
            .userDetailsService(userDetailsServiceBean());
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsServiceBean())
    .passwordEncoder(passwordEncoder());
}
}

访问令牌提供者返回了一个空访问令牌，根据春季oauth2中的合同，这是非法的

0 个答案: