Spring 引导资源服务器无效访问令牌

Question

我的 Spring 引导资源服务器配置已提供：

@Configuration
public class OAuth2SecurityConfig extends WebSecurityConfigurerAdapter {


    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {

        return new BCryptPasswordEncoder();
    }
}





@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {


    private static final String RESOURCE_ID = "couponservice";


    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId(RESOURCE_ID);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
                .mvcMatchers(HttpMethod.GET, "/couponapi/coupons/{code:^[A-Z]*$}").hasAnyRole("USER", "ADMIN")
                .mvcMatchers(HttpMethod.POST, "/couponapi/coupons").hasRole("ADMIN")
                .anyRequest().denyAll().and().csrf().disable();
    }


//  @Bean
//  public TokenStore tokenStore() {
//      return new JwtTokenStore(jwtAccessTokenConverter());
//  }
//
//  @Bean
//  public JwtAccessTokenConverter jwtAccessTokenConverter() {
//
//      JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
//      jwtAccessTokenConverter.setVerifierKey(publicKey);
//
//      return jwtAccessTokenConverter;
//  }

}

提供application.properties文件：

spring.datasource.url=jdbc:mysql://localhost:3306/mydb
spring.datasource.username=testuser
spring.datasource.password=testpassword

server.port=9091

spring.thymeleaf.cache=false
spring.main.allow-bean-definition-overriding=true


spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:9092/oauth/token_key
# security.oauth2.resource.jwt.key-uri=http://localhost:9092/oauth/token_key

如果我保留 JwtAccessTokenConverter 并使用正确的 public 键，则代码可以正常工作。但是，我想使用属性文件中提供的身份验证 URL 进行连接。

现在，当我发出 GET 请求时，我看到了无效的访问 toekn。这是什么问题，我该如何解决？

Answer 1

看来您需要告诉 Spring WHAT MECHANISM 才能使用授权。也许与这个 Curity 示例相比，它应该提供足够的线索来解决您的问题：

@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}")
    String issuerUri;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
                .authorizeRequests(authorizeRequests ->
                        authorizeRequests
                                .antMatchers("/services").hasAuthority("SCOPE_services:read")
                                .anyRequest().authenticated()
                )
                .oauth2ResourceServer(oauth2ResourceServer ->
                        oauth2ResourceServer
                                .jwt(jwt ->
                                        jwt.decoder(JwtDecoders.fromIssuerLocation(issuerUri))
                                )
                );
    }
}

Spring 引导资源服务器无效访问令牌

Spring Boot Resource Server Invalid Access Token

oauth-2.0

jwt

spring-boot