Spring Security OAuth -如何启用私有或公共访问令牌访问不同的资源

Question

我有两个终点。

/foo -是一个内部(半私有)端点。仅对已配置的客户端允许。(不需要用户名和凭据;但clientID是足够的)

/greetings -是私有端点。仅允许客户端和用户配置。(需要clientID和用户名和密码)

配置如下:

@Configuration
public class OAuth2ServerConfiguration {
    private static final String RESOURCE_ID = "restservice";
    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends
            ResourceServerConfigurerAdapter {
        @Override
        public void configure(ResourceServerSecurityConfigurer resources) {
            // @formatter:off
            resources
                .resourceId(RESOURCE_ID);
            // @formatter:on
        }
        @Override
        public void configure(HttpSecurity http) throws Exception {
            // @formatter:off
            http
                .authorizeRequests()
                    .antMatchers("/users").hasRole("ADMIN")
                    .antMatchers("/greeting").authenticated()
                    .antMatchers("/foo").authenticated();
            // @formatter:on
        }
    }
    @Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends
            AuthorizationServerConfigurerAdapter {
        private TokenStore tokenStore = new InMemoryTokenStore();
        @Autowired
        @Qualifier("authenticationManagerBean")
        private AuthenticationManager authenticationManager;
        @Autowired
        private CustomUserDetailsService userDetailsService;
        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints)
                throws Exception {
            // @formatter:off
            endpoints
                .tokenStore(this.tokenStore)
                .authenticationManager(this.authenticationManager)
                .userDetailsService(userDetailsService);
            // @formatter:on
        }
        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            // @formatter:off
            clients
                .inMemory()
                    .withClient("clientapp")
                        .authorizedGrantTypes("password", "refresh_token","authorization_code")
                        .authorities("USER","ROLE_CLIENT")
                        .scopes("read", "write")
                        .resourceIds(RESOURCE_ID)
                        .secret("123456")
                        .accessTokenValiditySeconds(600);
            // @formatter:on
        }
        @Bean
        @Primary
        public DefaultTokenServices tokenServices() {
            DefaultTokenServices tokenServices = new DefaultTokenServices();
            tokenServices.setSupportRefreshToken(true);
            tokenServices.setTokenStore(this.tokenStore);
            return tokenServices;
        }
        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception
        {
           oauthServer.checkTokenAccess("permitAll()");
        }
    }
}

这是控制器

@RestController
public class GreetingController {
    private static final String template = "Hello, %s! your password is %s";
    private final AtomicLong counter = new AtomicLong();
    @RequestMapping("/greeting")
    public Greeting greeting(@AuthenticationPrincipal User user) {
        return new Greeting(counter.incrementAndGet(), String.format(template, user.getName(),user.getPassword()));
    }
    @RequestMapping("/foo")
    public String foo(@AuthenticationPrincipal User user) {
        System.out.println(user==null);
        return "you are permitted here";
    }
}

我不能访问http://localhost:9001/foo没有任何令牌。所以当我尝试使用下面的curl获得访问令牌(注意我不传递用户名和密码，只有client_id和client_secret被传递)

c url -X POST -vu clientapp:123456 http://localhost:9001/oauth/token -H "Accept: application/json" -d "grant_type=password&scope=read%20write&client_secret=123456&client_id=clientapp"

我得到这个错误

{"error":"invalid_grant","error_description":"Bad credentials"}

我的配置有问题。我是使用Spring安全OAuth的初学者。如果有任何帮助，我将不胜感激。

谢谢

Answer 1

我认为你传错了grant_type…

curl -X POST -vu clientapp:123456 http://localhost:9001/oauth/token -H "Accept: application/json" -d "grant_type=client_credentials&scope=read%20write&client_secret=123456&client_id=clientapp"

也就我所记得的，你不应该在请求的头部和身体中复制client_id和client_secret。只有标题应该足够