没有这样的客户端异常 Spring Oauth2

Question

我正在尝试使用 Java 配置实施 Spring Security OAuth2。

我的用例需要使用密码 grant_type。

到目前为止，我已经配置了这个，不需要 web.xml 并且希望保持这种状态

我使用的版本：

Spring 框架：4.1.6
Spring 安全性：4.0.1
Spring 安全性 OAuth:2.0.7

为了更容易解释这一点，我在令牌端点上启用了 GET

    @Override
    public void configure
        (AuthorizationServerEndpointsConfigurer endpoints) throws Exception
    {
            endpoints
                .tokenStore(tokenStore)
                .authenticationManager(authenticationManager)
                .allowedTokenEndpointRequestMethods(HttpMethod.GET); //<-- Enable GET
    }

我提出的要求如下：

http://localhost:8080/project/oauth/token?
    client_id=testClient&
    grant_type=password&
    username=user&
    password=password

header 包含授权 header，其中包含以下编码版本：

Username: user
Password: password

我得到的异常是：

HTTP Status 500 - Request processing failed; nested exception is
   org.springframework.security.oauth2.provider.NoSuchClientException:
   No client with requested id: user

从异常描述看来，OAuth 正在 ClientDetailsService 中查找客户端：user。但是 user 是用户凭据。我显然对配置有一些误解。

我的配置如下；

ServletInitializer.java

public class ServletInitializer extends AbstractDispatcherServletInitializer {

    @Override
    protected WebApplicationContext createServletApplicationContext() {
        AnnotationConfigWebApplicationContext context = new AnnotationConfigWebApplicationContext();
        context.scan(ClassUtils.getPackageName(getClass()));
        return context;
    }

    @Override
    protected String[] getServletMappings() {
        return new String[]{"/"};
    }

    @Override
    protected WebApplicationContext createRootApplicationContext() {
        return null;
    }

    @Override
    public void onStartup(ServletContext servletContext) throws ServletException{
        super.onStartup(servletContext);
        DelegatingFilterProxy filter = new DelegatingFilterProxy("springSecurityFilterChain");
    filter.setContextAttribute("org.springframework.web.servlet.FrameworkServlet.CONTEXT.dispatcher");
        servletContext.addFilter("springSecurityFilterChain", filter).addMappingForUrlPatterns(null, false, "/*");
    }
}

WebMvcConfig.java

@Configuration
@EnableWebMvc
public class WebMvcConfig extends WebMvcConfigurerAdapter {

    @Override
    public void configureDefaultServletHandling(DefaultServletHandlerConfigurer configurer) {
            configurer.enable();
    }
}

SecurityConfiguration.java

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception{
        auth.
            inMemoryAuthentication()
            .withUser("user")
            .password("password")
            .roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception{
        http
            .authorizeRequests()
            .antMatchers("/Services/*")
            .authenticated()
        .and()
            .httpBasic();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

}

OAuth2ServerConfig.java

@Configuration
public class OAuth2ServerConfig {

    @Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter{

        @Autowired 
        private TokenStore tokenStore;

        @Autowired
        @Qualifier("authenticationManagerBean")
        private AuthenticationManager authenticationManager;

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception{

            clients
                .inMemory()
                    .withClient("testClient")
                    .secret("secret")
                    .scopes("read", "write")
                    .authorities("ROLE_CLIENT")
                    .authorizedGrantTypes("password", "refresh_token")
                    .accessTokenValiditySeconds(60)
                    .refreshTokenValiditySeconds(3600);
        }

        @Bean
        public TokenStore tokenStore() {
            return new InMemoryTokenStore();
        }

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception{
            endpoints
                .tokenStore(tokenStore)
                .authenticationManager(authenticationManager)
                .allowedTokenEndpointRequestMethods(HttpMethod.GET);
        }

        @Override 
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {

        }
    }

    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

        @Override
        public void configure(ResourceServerSecurityConfigurer resources){
            resources.resourceId("SomeResourseId").stateless(false);
        }

        @Override
        public void configure(HttpSecurity http) throws Exception{

            http
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
            .and()
                .authorizeRequests()
                    .antMatchers("/secure/**").access("#oauth2.hasScope('read')");
        }
    }
}

gitrepo 中的代码以便于访问：https://github.com/dooffas/springOauth2

Answer 1

您定义了不同的权限

试试这个：

@Autowired
    public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception{
        auth.
            inMemoryAuthentication()
            .withUser("user")
            .password("password")
            .roles("USER", "CLIENT");
    }

并在您的请求中添加参数 grant_type=password

Answer 2

我不确定你的 500 是从哪里来的。我看到一个 406，因为没有用于访问令牌的 JSON 转换器（Spring 过去默认为 Jackson 1.* 注册一个，但现在它只为 Jackson 2.* 注册）。如果我将 jackson-databind 添加到类路径，你的令牌端点对我有用，例如

<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>2.4.4</version>
    <scope>runtime</scope>
</dependency>

这对我有用：

$ curl -v testClient:secret@localhost:8080/oauth/token?'grant_type=password&username=user&password=password'

P.S。您真的不应该将 GET 用于令牌请求。

没有这样的客户端异常 Spring Oauth2

No Such Client Exception Spring Oauth2

java

spring

oauth

spring-security

oauth-2.0