小贝子编程

保护微服务春季云安全Oauth2



我正在使用Spring云安全和Oauth2来保护我的微服务。现在Pom如下：

http://maven.apache.org/xsd/maven-4.0.0.xsd">4.0.0

<groupId>com.oreilly.cloud</groupId>
<artifactId>spring-microservices-oauth-server</artifactId>
<version>0.0.1-SNAPSHOT</version>
<packaging>jar</packaging>
<name>spring-microservices-oauth-server</name>
<description>Demo project for Spring Boot</description>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>1.5.7.RELEASE</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<java.version>1.8</java.version>
<spring-cloud.version>Dalston.SR3</spring-cloud.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-oauth2</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.hsqldb</groupId>
<artifactId>hsqldb</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
<version>${spring-cloud.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
<repositories>
<repository>
<id>spring-snapshots</id>
<name>Spring Snapshots</name>
<url>https://repo.spring.io/snapshot</url>
<snapshots>
<enabled>true</enabled>
</snapshots>
</repository>
<repository>
<id>spring-milestones</id>
<name>Spring Milestones</name>
<url>https://repo.spring.io/milestone</url>
<snapshots>
<enabled>false</enabled>
</snapshots>
</repository>
</repositories>

Spring引导主类如下：

package com.oreilly.cloud;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@SpringBootApplication
@EnableAuthorizationServer
@EnableResourceServer
@RestController
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class SpringMicroservicesOauthServerApplication {
@RequestMapping("/resource/endpoint")
@PreAuthorize("hasRole('ADMIN')")
public String endpoint(){
return "This message is protected by the resource server.";
}
public static void main(String[] args) {
SpringApplication.run(SpringMicroservicesOauthServerApplication.class, args);
}
}

授权服务器配置如下：

package com.oreilly.cloud;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerEndpointsConfigurer;
@Configuration
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
@Autowired
private AuthenticationManager authManager;
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.authenticationManager(authManager);
}
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory().withClient("webapp").secret("websecret").authorizedGrantTypes("password")
.scopes("read,write,trust");
}
}

请注意，身份验证管理器自动连接到授权配置

在下面的类中，身份验证管理器被配置并作为abean返回，以便它可以自动连接到上面的类：

package com.oreilly.cloud;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("user1").password("password1").roles("USER").and().withUser("admin")
.password("password2").roles("ADMIN");
}
}

现在application.properties如下：

server.port=9090

现在我运行Spring引导应用程序如下：

mvn弹簧引导：运行

应用程序成功启动，并准备接受localhost 上端口9090上的请求

现在，我使用poster发送一个post请求以获取access_token。一个小背景是，这里使用的Aoauth2流是密码授予。因此，在上面的AuthorizationServerConfig类中，我定义了一个密码授予流，并注册了一个带有客户端名称和机密的简单web应用程序。可以看出，客户端配置在内存中。

从授权服务器获取访问令牌的post-man请求如下：它的post请求，其中Basic auth标头具有用户名为webapp，密码为websecret。

http://localhost:9090/oauth/token?grant_type=password&username=user1&password=密码1

此请求成功返回，并带有访问令牌json，如下所示：

{
"access_token": "2d632e54-17c3-41f7-af3b-935ca3022d78",
"token_type": "bearer",
"expires_in": 43199,
"scope": "read,write,trust"
}

现在，当我尝试使用上面的访问令牌访问/resources/endpoint时，如下所示：

http://localhost:9090/resource/endpoint?access_token=2d632e54-17c3-41f7-af3b-935ca3022d78

它没有返回从服务/resources/endpoint返回的文本，而是返回如下登录页面：

<html>
<head>
<title>Login Page</title>
</head>
<body onload='document.f.username.focus();'>
<h3>Login with Username and Password</h3>
<form name='f' action='/login' method='POST'>
<table>
<tr>
<td>User:</td>
<td>
<input type='text' name='username' value=''>
</td>
</tr>
<tr>
<td>Password:</td>
<td>
<input type='password' name='password'/>
</td>
</tr>
<tr>
<td colspan='2'>
<input name="submit" type="submit" value="Login"/>
</td>
</tr>
<input name="_csrf" type="hidden" value="8dbc1c38-6f89-43c5-a8f8-797c920722a1" />
</table>
</form>
</body>
</html>

有人能帮我吗？？？？？。

注意我在同一个应用程序中配置了授权服务器和资源服务器。这是一个POC，所以我正在尝试Spring云安全，稍后我将把两者分开。。。但那是以后的事。

我通过查看Spring Boot的根调试日志发现了这个问题。

如果您使用yml:

src/main/resources/application.yml
----------------------------------
logging:
level:
root: DEBUG

或者如果properties:

src/main/resources/application.properties
----------------------------------
logging.level.root=DEBUG

我意识到我没有用GET:传递任何用户身份验证信息

o.s.s.w.a.ExceptionTranslationFilter: Access is denied (user is anonymous); ...

所以你可以做两件事中的一件：

1.通过url参数添加creds

curl -X GET 
'http://localhost:9090/resource/endpoint?
username=user1&password=password1&access_token=xxxx'

或

2.通过基本身份验证添加信用

curl -X GET 
'http://localhost:9090/resource/endpoint?username=user1' 
-H 'Authorization: Basic xxxxxxxxxxxxx

您是否也从safaribooksonline上的使用Spring构建微服务课程中获得了这一点？：)

我发现了为什么老师没有这个问题。他之前一定已经授权了用户名/密码——它似乎被缓存在某个地方，因为在你GET资源一次之后，如果你只用auth_token再次调用它，它就会工作。

相关内容

最新更新


热门标签：

javascript python java c# php android html jquery c++ css ios sql mysql arrays asp.net json python-3.x ruby-on-rails .net sql-server django objective-c excel regex ruby linux ajax iphone xml vba spring asp.net-mvc database wordpress string postgresql wpf windows xcode bash git oracle list vb.net multithreading eclipse algorithm macos powershell visual-studio image forms numpy scala function api selenium