在Spring Security Oauth2中使用RemoteTokenServices配置资源服务器

最后发布: 2016-11-15 10:30:58


问题

我正在尝试使用spring security oauth2实现授权服务器和资源服务器。 到目前为止,我已设法设置授权服务器,因为我不想共享一个jdbc令牌存储,我正在尝试使用remoteTokenService来验证我的令牌@资源服务器。 但是每当我尝试访问资源REST方法时,我都会收到401错误。

由于项目的性质,我正在使用xml配置来设置spring安全性。 我已尝试使用Javaconfig的另一个示例项目,并且其工作正常。

这是我在资源服务器中的配置。

web.xml中

<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://java.sun.com/xml/ns/javaee"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
         version="3.0" metadata-complete="true">

    <display-name>rest-project</display-name>
    <description>rest project Implementation</description>

    <!--
        - Location of the XML file that defines the root application context.
        - Applied by ContextLoaderListener.
    -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring/*.xml</param-value>
    </context-param>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>


    <!--
    - Servlet that dispatches request to registered handlers (Controller implementations).
    -->
    <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:spring/mvc-core-config.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

</web-app>

这是我的security-config.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:context="http://www.springframework.org/schema/context"
             xmlns:oauth2="http://www.springframework.org/schema/security/oauth2"
             xmlns:p="http://www.springframework.org/schema/p"
             xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
                        http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd">



    <http pattern="/cards/**" use-expressions="true" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint">
        <anonymous enabled="false"/>
        <intercept-url pattern="/cards/**" access="isAuthenticated()" requires-channel="https"/>
        <access-denied-handler ref="oauthAccessDeniedHandler"/>
    </http>

    <oauth2:resource-server id="resourceServerFilter" resource-id="connector-bus" token-services-ref="tokenServices"/>

    <beans:bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.RemoteTokenServices">
        <beans:property name="checkTokenEndpointUrl" value="https://localhost:8443/auth-server/api/oauth/check_token"/>
        <beans:property name="clientId" value="123456" />
        <beans:property name="clientSecret" value="456"/>
    </beans:bean>


    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
                </user-service>
        </authentication-provider>
    </authentication-manager>


    <beans:bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"/>

    <beans:bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
</beans:beans>

请指出我在这里缺少的东西。

提前致谢。

java xml spring spring-security spring-security-oauth2
回答

出于某种原因,我无法使xml配置工作以远程验证访问令牌。 但我能够使用java配置设置oauth2资源服务器,它解决了这个问题。 请在下面找到代码。

@Configuration
@EnableWebSecurity
@EnableResourceServer
public class Oauth2ResesourceServerConfiguration  extends ResourceServerConfigurerAdapter{


    @Override
    public void configure(HttpSecurity http) throws Exception {
         http.authorizeRequests()
                .antMatchers(HttpMethod.GET,"/api/**").access("#oauth2.hasScope('read')");
    }

    @Primary
    @Bean
    public RemoteTokenServices tokenService() {
        RemoteTokenServices tokenService = new RemoteTokenServices();
        tokenService.setCheckTokenEndpointUrl(
                "https://localhost:8443/auth-server/oauth/check_token");
        tokenService.setClientId("client-id");
        tokenService.setClientSecret("client-secret");
        return tokenService;
    }



}


回答

/oauth/check_token必须单独配置权限,默认为'denyAll'。 如果在属性中添加logging.level.org.springframework.security=DEBUG ,则可以找到以下日志记录行:

2017-09-14 14:52:01.379  INFO 15591 --- [           main] b.a.s.AuthenticationManagerConfiguration : 
Using default security password: f1f7e508-4a30-4aad-914f-d0e90da6079a
2017-09-14 14:52:01.775 DEBUG 15591 --- [           main] edFilterInvocationSecurityMetadataSource : Adding web access control expression 'fullyAuthenticated', for Ant [pattern='/oauth/token']
2017-09-14 14:52:01.872 DEBUG 15591 --- [           main] edFilterInvocationSecurityMetadataSource : Adding web access control expression 'denyAll()', for Ant [pattern='/oauth/token_key']
2017-09-14 14:52:01.879 DEBUG 15591 --- [           main] edFilterInvocationSecurityMetadataSource : Adding web access control expression 'denyAll()', for Ant [pattern='/oauth/check_token']

我不知道如何在xml中允许它,但是通过javaconfig如下

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security.checkTokenAccess("isAuthenticated()");
        // security.checkTokenAccess("permitAll");
    }
}

我找到了如何使用XML使用Spring Security Oauth2启用/ oauth / check_token 也许有帮助。


回答

除了在https://stackoverflow.com/a/40626102/3044680中说明你的tokenService方法@Primary ,从springboot 1.5开始,将security.oauth2.resource.filter-order = 3添加到application.properties


回答

您可以通过属性配置简化这项工作。 尝试将它放在application.yml中,以及/ cards / URI的HttpSecurity配置。

security:
  oauth2:
    resource:
      token-info-uri: https://[your token validation endpoint]
      preferTokenInfo: true

@EnableWebSecurity和@EnableResourceServer是重复的。 您不需要@EnableWebSecurity。