Spring Security OAuth2 正确的授权管理器 [英] Spring Security OAuth2 correct Authorization Manager

问题描述

我尝试配置 Spring Security OAuth2.我必须身份验证管理器:clientAuthenticationManager 和authManager.如果我理解正确，clientAuthenticationManager 用于客户端授权(通过客户端 ID 和客户端密码)而 authManager 用于用户授权(通过用户登录名和密码)，我对吗?

I try to configure Spring Security OAuth2. I have to authentication manager: clientAuthenticationManager and authManager. If I understand correctly clientAuthenticationManager is used to client authorization (by client id and client secret) and authManager is used to user authorization (by user login and password) am I right?

但是当我调试我的应用程序时，我看到当我发送 http://localhost:8080/myApp/oauth/token 请求时，authManager(不是clientAuthenticationManager).

But when I debug my application I see when I send http://localhost:8080/myApp/oauth/token request that autorization is made by authManager (not clientAuthenticationManager).

我的配置:

    <?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
    xmlns:sec="http://www.springframework.org/schema/security"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
    http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd" >

    <http pattern="/oauth/token" create-session="stateless"
        authentication-manager-ref="authenticationManager"
        xmlns="http://www.springframework.org/schema/security">
    <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <anonymous enabled="false" />
    <http-basic entry-point-ref="clientAuthenticationEntryPoint" />

    <custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
    </http>

    <http pattern="/API/**" create-session="never"
        entry-point-ref="oauthAuthenticationEntryPoint"
        access-decision-manager-ref="accessDecisionManager"
        xmlns="http://www.springframework.org/schema/security">
    <anonymous enabled="false" />

    <intercept-url pattern="/API/**" access="ROLE_RESTREAD" method="GET" />
    <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>

<http auto-config="false" use-expressions="true"
    disable-url-rewriting="true">
    <intercept-url pattern="/isSessionValid" access="permitAll"
        requires-channel="any" />
    <intercept-url pattern="/**" access="isAuthenticated()"
        requires-channel="any" />
    <form-login login-page="/login" authentication-failure-url="/loginFailed"
        default-target-url="/loginSuccess" always-use-default-target="true" />
    <logout logout-success-url="/login" />
    <session-management>
        <concurrency-control max-sessions="1" />
    </session-management>
</http>

<oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices">  
    <oauth:client-credentials />  
</oauth:authorization-server>
<oauth:resource-server id="resourceServerFilter" token-services-ref="tokenServices" />
<oauth:expression-handler id="oauthExpressionHandler" />
<oauth:web-expression-handler id="oauthWebExpressionHandler" />

<beans:bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore" >
    <beans:constructor-arg ref="dataSource" />
</beans:bean>
<beans:bean id="clientDetails" class="org.springframework.security.oauth2.provider.client.JdbcClientDetailsService" >
    <beans:constructor-arg ref="dataSource" />
</beans:bean>
<beans:bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
    <beans:property name="tokenStore" ref="tokenStore" />
    <beans:property name="supportRefreshToken" value="false" />
    <beans:property name="clientDetailsService" ref="clientDetails" />
    <beans:property name="accessTokenValiditySeconds" value="400000" />
    <beans:property name="refreshTokenValiditySeconds" value="0" />
</beans:bean>
<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" >
    <beans:constructor-arg>
        <beans:list>
            <beans:bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
            <beans:bean class="org.springframework.security.access.vote.RoleVoter" />
            <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
        </beans:list>
    </beans:constructor-arg>
</beans:bean>
<beans:bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <beans:property name="realmName" value="theRealm" />
</beans:bean>
<beans:bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <beans:property name="realmName" value="theRealm/client" />
    <beans:property name="typeName" value="Basic" />
</beans:bean>
<beans:bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
    <beans:property name="authenticationManager" ref="clientAuthenticationManager" />
</beans:bean>
<beans:bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
    <beans:constructor-arg ref="clientDetails" />
</beans:bean>
<beans:bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
<global-method-security pre-post-annotations="enabled" proxy-target-class="true">
    <expression-handler ref="oauthExpressionHandler" />
</global-method-security>
<authentication-manager alias="clientAuthenticationManager">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>


<beans:bean id="userRepository" class="pl.execon.grm.repository.UserRepository">
    <beans:property name="sessionFactory" ref="sessionFactory" />
</beans:bean>

<beans:bean id="userDetailsService" class="pl.execon.grm.auth.GRMUserDataService">
    <beans:property name="userRepository" ref="userRepository" />
</beans:bean>

<authentication-manager alias="authManager">
    <authentication-provider user-service-ref='userDetailsService'>
        <password-encoder hash="md5" />
    </authentication-provider>
</authentication-manager>

推荐答案

我找到了我的问题所在:

I find what make my problem:

在代码中:

<authentication-manager alias="clientAuthenticationManager">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>

我写的是 alias 而不是 id 所以它应该是:

I write alias not id so it should be:

<authentication-manager id="clientAuthenticationManager">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>

当我使用 alias 默认身份验证管理器来解决 OAuth 客户端问题时.

When I have alias default authentication manager was taken to resolve OAuth clients what makes my problem.

这篇关于Spring Security OAuth2 正确的授权管理器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！