如何在Spring Boot应用程序上启用Bearer身份validation？
我想要实现的是：
- 存储在通过jdbc访问的数据库（即MySQL）中的用户，权限，客户端和访问令牌
- API公开了端点，让您问“我可以拥有OAuth2不记名令牌吗？我知道客户端ID和密码”
- 如果您在请求标头中提供Bearer令牌，则API允许您访问MVC端点
我对此非常了解 – 前两点正在发挥作用。
我无法为我的Spring Boot应用程序使用完全默认的OAuth2设置，因为标准表名已经在我的数据库中使用（例如，我已经有一个“用户”表）。
我手动构建了自己的JdbcTokenStore，JdbcClientDetailsService和JdbcAuthorizationCodeServices实例，将它们配置为使用我的数据库中的自定义表名，并设置我的应用程序以使用这些实例。
所以，这就是我到目前为止所拥有的。 我可以要求持票人令牌：
# The `-u` switch provides the client ID & secret over HTTP Basic Auth curl -u8fc9d384-619a-11e7-9fe6-246798c61721:9397ce6c-619a-11e7-9fe6-246798c61721 \ 'http://localhost:8080/oauth/token' \ -d grant_type=password \ -d username=bob \ -d password=tom 我收到回复; 太好了！
{"access_token":"1ee9b381-e71a-4e2f-8782-54ab1ce4d140","token_type":"bearer","refresh_token":"8db897c7-03c6-4fc3-bf13-8b0296b41776","expires_in":26321,"scope":"read write"}
现在我尝试使用该令牌：
curl 'http://localhost:8080/test' \ -H "Authorization: Bearer 1ee9b381-e71a-4e2f-8782-54ab1ce4d140"
唉：
{ "timestamp":1499452163373, "status":401, "error":"Unauthorized", "message":"Full authentication is required to access this resource", "path":"/test" }
这意味着（在这种特殊情况下）它已经回归到匿名身份validation。 如果我将.anonymous().disable()到我的HttpSecurity，你可以看到真正的错误：
{ "timestamp":1499452555312, "status":401, "error":"Unauthorized", "message":"An Authentication object was not found in the SecurityContext", "path":"/test" }
我通过增加日志记录的详细程度对此进行了更深入的调查：
logging.level: org.springframework: security: DEBUG
这揭示了我的请求通过的10个filter：
ossecurity.web.FilterChainProxy : /test at position 1 of 10 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter' ossecurity.web.FilterChainProxy : /test at position 2 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' wcHttpSessionSecurityContextRepository : No HttpSession currently exists wcHttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created. ossecurity.web.FilterChainProxy : /test at position 3 of 10 in additional filter chain; firing Filter: 'HeaderWriterFilter' ossecurity.web.FilterChainProxy : /test at position 4 of 10 in additional filter chain; firing Filter: 'LogoutFilter' ossecurity.web.FilterChainProxy : /test at position 5 of 10 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' ossecurity.web.FilterChainProxy : /test at position 6 of 10 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' ossecurity.web.FilterChainProxy : /test at position 7 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' ossecurity.web.FilterChainProxy : /test at position 8 of 10 in additional filter chain; firing Filter: 'SessionManagementFilter' ossecurity.web.FilterChainProxy : /test at position 9 of 10 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' ossecurity.web.FilterChainProxy : /test at position 10 of 10 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' osswaiFilterSecurityInterceptor : Secure object: FilterInvocation: URL: /test; Attributes: [authenticated] osswaExceptionTranslationFilter : Authentication exception occurred; redirecting to authentication entry point org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:379) ~[spring-security-core-4.2.3.RELEASE.jar:4.2.3.RELEASE]
如果匿名用户被禁用，那就是它的样子。 如果它们被启用 ： AnonymousAuthenticationFilter被添加到SecurityContextHolderAwareRequestFilter之后的filter链中，并且序列结束更像这样：
ossecurity.web.FilterChainProxy : /test at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' osswaiFilterSecurityInterceptor : Secure object: FilterInvocation: URL: /test; Attributes: [authenticated] osswaiFilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS ossaccess.vote.AffirmativeBased : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@5ff24abf, returned: -1 osswaExceptionTranslationFilter : Access is denied (user is anonymous); redirecting to authentication entry point org.springframework.security.access.AccessDeniedException: Access is denied at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-4.2.3.RELEASE.jar:4.2.3.RELEASE]
无论哪种方式：没有好处。
从本质上讲，它向我表明我们错过了过滤链中的一些步骤。 我们需要一个filter来读取ServletRequest的头部，然后填充安全上下文的身份validation：
SecurityContextHolder.getContext().setAuthentication(request: HttpServletRequest);
我想知道如何获得这样的filter？
这就是我的应用程序的样子。 这是Kotlin，但希望它对Java眼睛有意义。
Application.kt：
@SpringBootApplication(scanBasePackageClasses=arrayOf( com.example.domain.Package::class, com.example.service.Package::class, com.example.web.Package::class )) class MyApplication fun main(args: Array) { SpringApplication.run(MyApplication::class.java, *args) }
的TestController：
@RestController class TestController { @RequestMapping("/test") fun Test(): String { return "hey there" } }
MyWebSecurityConfigurerAdapter：
@Configuration @EnableWebSecurity /** * Based on: * https://stackoverflow.com/questions/25383286/spring-security-custom-userdetailsservice-and-custom-user-class * * Password encoder: * http://www.baeldung.com/spring-security-authentication-with-a-database */ class MyWebSecurityConfigurerAdapter( val userDetailsService: MyUserDetailsService ) : WebSecurityConfigurerAdapter() { private val passwordEncoder = BCryptPasswordEncoder() override fun userDetailsService() : UserDetailsService { return userDetailsService } override fun configure(auth: AuthenticationManagerBuilder) { auth .authenticationProvider(authenticationProvider()) } @Bean fun authenticationProvider() : AuthenticationProvider { val authProvider = DaoAuthenticationProvider() authProvider.setUserDetailsService(userDetailsService()) authProvider.setPasswordEncoder(passwordEncoder) return authProvider } override fun configure(http: HttpSecurity?) { http!! .anonymous().disable() .authenticationProvider(authenticationProvider()) .authorizeRequests() .anyRequest().authenticated() .and() .httpBasic() .and() .csrf().disable() } }
MyAuthorizationServerConfigurerAdapter：
/** * Based on: * https://github.com/spring-projects/spring-security-oauth/blob/master/tests/annotation/jdbc/src/main/java/demo/Application.java#L68 */ @Configuration @EnableAuthorizationServer class MyAuthorizationServerConfigurerAdapter( val auth : AuthenticationManager, val dataSource: DataSource, val userDetailsService: UserDetailsService ) : AuthorizationServerConfigurerAdapter() { private val passwordEncoder = BCryptPasswordEncoder() @Bean fun tokenStore(): JdbcTokenStore { val tokenStore = JdbcTokenStore(dataSource) val oauthAccessTokenTable = "auth_schema.oauth_access_token" val oauthRefreshTokenTable = "auth_schema.oauth_refresh_token" tokenStore.setDeleteAccessTokenFromRefreshTokenSql("delete from ${oauthAccessTokenTable} where refresh_token = ?") tokenStore.setDeleteAccessTokenSql("delete from ${oauthAccessTokenTable} where token_id = ?") tokenStore.setDeleteRefreshTokenSql("delete from ${oauthRefreshTokenTable} where token_id = ?") tokenStore.setInsertAccessTokenSql("insert into ${oauthAccessTokenTable} (token_id, token, authentication_id, " + "user_name, client_id, authentication, refresh_token) values (?, ?, ?, ?, ?, ?, ?)") tokenStore.setInsertRefreshTokenSql("insert into ${oauthRefreshTokenTable} (token_id, token, authentication) values (?, ?, ?)") tokenStore.setSelectAccessTokenAuthenticationSql("select token_id, authentication from ${oauthAccessTokenTable} where token_id = ?") tokenStore.setSelectAccessTokenFromAuthenticationSql("select token_id, token from ${oauthAccessTokenTable} where authentication_id = ?") tokenStore.setSelectAccessTokenSql("select token_id, token from ${oauthAccessTokenTable} where token_id = ?") tokenStore.setSelectAccessTokensFromClientIdSql("select token_id, token from ${oauthAccessTokenTable} where client_id = ?") tokenStore.setSelectAccessTokensFromUserNameAndClientIdSql("select token_id, token from ${oauthAccessTokenTable} where user_name = ? and client_id = ?") tokenStore.setSelectAccessTokensFromUserNameSql("select token_id, token from ${oauthAccessTokenTable} where user_name = ?") tokenStore.setSelectRefreshTokenAuthenticationSql("select token_id, authentication from ${oauthRefreshTokenTable} where token_id = ?") tokenStore.setSelectRefreshTokenSql("select token_id, token from ${oauthRefreshTokenTable} where token_id = ?") return tokenStore } override fun configure(security: AuthorizationServerSecurityConfigurer?) { security!!.passwordEncoder(passwordEncoder) } override fun configure(clients: ClientDetailsServiceConfigurer?) { val clientDetailsService = JdbcClientDetailsService(dataSource) clientDetailsService.setPasswordEncoder(passwordEncoder) val clientDetailsTable = "auth_schema.oauth_client_details" val CLIENT_FIELDS_FOR_UPDATE = "resource_ids, scope, " + "authorized_grant_types, web_server_redirect_uri, authorities, access_token_validity, " + "refresh_token_validity, additional_information, autoapprove" val CLIENT_FIELDS = "client_secret, ${CLIENT_FIELDS_FOR_UPDATE}" val BASE_FIND_STATEMENT = "select client_id, ${CLIENT_FIELDS} from ${clientDetailsTable}" clientDetailsService.setFindClientDetailsSql("${BASE_FIND_STATEMENT} order by client_id") clientDetailsService.setDeleteClientDetailsSql("delete from ${clientDetailsTable} where client_id = ?") clientDetailsService.setInsertClientDetailsSql("insert into ${clientDetailsTable} (${CLIENT_FIELDS}," + " client_id) values (?,?,?,?,?,?,?,?,?,?,?)") clientDetailsService.setSelectClientDetailsSql("${BASE_FIND_STATEMENT} where client_id = ?") clientDetailsService.setUpdateClientDetailsSql("update ${clientDetailsTable} set " + "${CLIENT_FIELDS_FOR_UPDATE.replace(", ", "=?, ")}=? where client_id = ?") clientDetailsService.setUpdateClientSecretSql("update ${clientDetailsTable} set client_secret = ? where client_id = ?") clients!!.withClientDetails(clientDetailsService) } override fun configure(endpoints: AuthorizationServerEndpointsConfigurer?) { endpoints!! .authorizationCodeServices(authorizationCodeServices()) .authenticationManager(auth) .tokenStore(tokenStore()) .approvalStoreDisabled() .userDetailsService(userDetailsService) } @Bean protected fun authorizationCodeServices() : AuthorizationCodeServices { val codeServices = JdbcAuthorizationCodeServices(dataSource) val oauthCodeTable = "auth_schema.oauth_code" codeServices.setSelectAuthenticationSql("select code, authentication from ${oauthCodeTable} where code = ?") codeServices.setInsertAuthenticationSql("insert into ${oauthCodeTable} (code, authentication) values (?, ?)") codeServices.setDeleteAuthenticationSql("delete from ${oauthCodeTable} where code = ?") return codeServices } }
MyAuthorizationServerConfigurerAdapter：
@Service class MyUserDetailsService( val theDataSource: DataSource ) : JdbcUserDetailsManager() { @PostConstruct fun init() { dataSource = theDataSource val usersTable = "auth_schema.users" val authoritiesTable = "auth_schema.authorities" setChangePasswordSql("update ${usersTable} set password = ? where username = ?") setCreateAuthoritySql("insert into ${authoritiesTable} (username, authority) values (?,?)") setCreateUserSql("insert into ${usersTable} (username, password, enabled) values (?,?,?)") setDeleteUserAuthoritiesSql("delete from ${authoritiesTable} where username = ?") setDeleteUserSql("delete from ${usersTable} where username = ?") setUpdateUserSql("update ${usersTable} set password = ?, enabled = ? where username = ?") setUserExistsSql("select username from ${usersTable} where username = ?") setAuthoritiesByUsernameQuery("select username,authority from ${authoritiesTable} where username = ?") setUsersByUsernameQuery("select username,password,enabled from ${usersTable} " + "where username = ?") } }
有任何想法吗？ 可能是因为我需要以某种方式将OAuth2AuthenticationProcessingFilter安装到我的filter链中吗？
我确实在启动时收到了这样的消息……这些可能与问题有关吗？
ucchsauth.MyUserDetailsService : No authentication manager set. Reauthentication of users when changing passwords will not be performed. scawcWebSecurityConfigurerAdapter$3 : No authenticationProviders and no parentAuthenticationManager defined. Returning null.
编辑：
看起来安装OAuth2AuthenticationProcessingFilter是ResourceServerConfigurerAdapter的工作。 我添加了以下类：
MyResourceServerConfigurerAdapter：
@Configuration @EnableResourceServer class MyResourceServerConfigurerAdapter : ResourceServerConfigurerAdapter()
我在调试器中确认这导致ResourceServerSecurityConfigurer进入其configure(http: HttpSecurity)方法，看起来它试图将OAuth2AuthenticationProcessingFilter安装到filter链中。
但它看起来并不成功。 根据Spring Security的调试输出：我的filter链中仍然有相同数量的filter。 OAuth2AuthenticationProcessingFilter不在那里。 这是怎么回事？
EDIT2 ：我想知道问题是我有两个类（ WebSecurityConfigurerAdapter ， ResourceServerConfigurerAdapter ）试图配置HttpSecurity。 它是互相排斥的吗？
是! 问题与我注册了WebSecurityConfigurerAdapter 和 ResourceServerConfigurerAdapter这一事实有关。
解决方案：删除WebSecurityConfigurerAdapter 。 并使用此ResourceServerConfigurerAdapter ：
@Configuration @EnableResourceServer class MyResourceServerConfigurerAdapter( val userDetailsService: MyUserDetailsService ) : ResourceServerConfigurerAdapter() { private val passwordEncoder = BCryptPasswordEncoder() override fun configure(http: HttpSecurity?) { http!! .authenticationProvider(authenticationProvider()) .authorizeRequests() .anyRequest().authenticated() .and() .httpBasic() .and() .csrf().disable() } @Bean fun authenticationProvider() : AuthenticationProvider { val authProvider = DaoAuthenticationProvider() authProvider.setUserDetailsService(userDetailsService) authProvider.setPasswordEncoder(passwordEncoder) return authProvider } }
编辑 ：为了让Bearer auth应用于所有端点（例如Spring Actuator安装的/metrics端点），我发现我还必须将security.oauth2.resource.filter-order: 3添加到我的application.yml 。 看到这个答案 。