AWS Cognito Angular SpringBoot Oauth2 - invalid_token error

Question

我们将AWS Cognito用于Oauth2。我们的UI是基于Angular构建的。用户登录后，我启动对Cognito的调用以获取授权令牌。我正在使用PKCE的授权代码授予来从Cognito获取令牌。从Cognito获得toke后，我调用了Spring Boot REST服务。当从Angular调用Spring Boot服务时，我将Authorization标头中的令牌发送为"；Bearer"；代币

这是我的ResourceServerConfiguration.java：

import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
private static final String RESOURCE_ID = "resource-server-rest-api";
private static final String SECURED_READ_SCOPE = "#oauth2.hasScope('openid')";
private static final String SECURED_WRITE_SCOPE = "#oauth2.hasScope('openid')";
private static final String SECURED_PATTERN = "/**";
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.resourceId(RESOURCE_ID);
}
@Override
public void configure(HttpSecurity http) throws Exception {
http.requestMatchers()
.antMatchers(SECURED_PATTERN).and().authorizeRequests()
.antMatchers(HttpMethod.POST, SECURED_PATTERN).access(SECURED_WRITE_SCOPE)
.anyRequest().access(SECURED_READ_SCOPE);
}
}

当调用REST服务时，我的Angular UI得到HTTP响应401，并显示以下错误消息：

DEBUG o.s.s.o.p.a.OAuth2AuthenticationProcessingFilter - Authentication request failed: error="invalid_token", error_description="Invalid access token: eyJraWQiOiIy.......

1. 知道我为什么会变成invalid_token吗
2. spring是否调用Cognito来验证令牌
3. 我没有将令牌存储在我的REST服务层中。这是必需的吗
4. 我使用logging.level.root=DEBUG启用了DEBUG。但在输出中并没有看到描述性消息。如何解决此问题

Answer 1

以下更改对我有效

• 删除@EnableResourceServer

• 将以下内容添加到您的春季安全配置中

http.authorizeRequests().antMatchers(HttpMethod.OPTIONS,"**").permitAll()
.anyRequest()
.authenticated()
.and().oauth2ResourceServer().jwt();

• 向pom.xml添加以下2个依赖项

<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-resource-server</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-jose</artifactId>
</dependency>

• 最后将以下属性添加到您的应用程序中。yml

spring:
security:
oauth2:
resourceserver:
jwt:
issuer-uri: https://cognito-idp.us-east-1.amazonaws.com/{{userpoolid}}
com:
ixortalk:
security:
jwt:
aws:
userPoolId: {{userpoolid}}
region: "us-east-1"