不知道為什么，授權服務和資源服務分開放兩個服務，專案是沒問題的，訪問資源服務所在專案方法也需要認證授權，但是二者在同一個服務上訪問所有方法都不需要認證就可以訪問，得不到注入的Authentication authentication
一個服務上（授權和資源服務放在一塊）的專案結構
分開時專案結構：
這個是資源服務代碼
@EnableResourceServer//@EnableResourceServer 注解自動增加了一個型別為 OAuth2AuthenticationProcessingFilter 的過濾器鏈，
@Configuration
@EnableWebSecurity
public class ResourceServerConfigurer extends ResourceServerConfigurerAdapter {
@Override
public void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.authorizeRequests().anyRequest().authenticated();
}
@Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
super.configure(resources);
resources.tokenServices(tokenServices());
}
@Bean
public JwtTokenStore jwtTokenStore() {
return new JwtTokenStore(accessTokenConverter());
}
@Bean
public JwtAccessTokenConverter accessTokenConverter() {
JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
converter.setSigningKey("123");
return converter;
}
/**
* resourceServerTokenServices 類的實體，用來實作令牌服務。
* @return
*/
@Bean
@Primary
public DefaultTokenServices tokenServices() {
DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
defaultTokenServices.setTokenStore(jwtTokenStore());
return defaultTokenServices;
}
}
這個是授權服務代碼
@Configuration
@ComponentScan
public class OauthConfiguration implements AuthorizationServerConfigurer {
/**
*無法注入時候在WebSecurityConfigurerAdapter的實作類當中，重寫authenticationManagerBean方法：
*/
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
private UserService userService;
/**
* 用來配置令牌端點(Token Endpoint)的安全約束.
* @param authorizationServerSecurityConfigurer
* @throws Exception
*/
@Override
public void configure(AuthorizationServerSecurityConfigurer authorizationServerSecurityConfigurer) throws Exception {
authorizationServerSecurityConfigurer.allowFormAuthenticationForClients()
.checkTokenAccess("isAuthenticated()")
.tokenKeyAccess("permitAll()");
}
@Override
public void configure(ClientDetailsServiceConfigurer clientDetailsServiceConfigurer) throws Exception {
clientDetailsServiceConfigurer.inMemory().withClient("itqinbo")
.secret("123456")//7c42e528-bf84-4563-b5d1-bfcf5ac55559
.authorizedGrantTypes("password", "refresh_token")
.refreshTokenValiditySeconds(7 * 24 * 3600 * 1000)
.accessTokenValiditySeconds(1 * 24 * 3600 * 1000)
.scopes("read", "write");
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.allowedTokenEndpointRequestMethods(HttpMethod.GET, HttpMethod.POST);
endpoints.authenticationManager(authenticationManager());
endpoints.tokenStore(jwtTokenStore());
endpoints.accessTokenConverter(accessTokenConverter());
endpoints.userDetailsService(userService);
endpoints.pathMapping("/oauth/token","/itqinbo/token");
ClientDetailsService clientDetails = endpoints.getClientDetailsService();
AuthorizationServerTokenServices tokenServices = endpoints.getTokenServices();
AuthorizationCodeServices authorizationCodeServices = endpoints.getAuthorizationCodeServices();
OAuth2RequestFactory requestFactory = endpoints.getOAuth2RequestFactory();
List<TokenGranter> tokenGranters = new ArrayList<>();
tokenGranters.add(new AuthorizationCodeTokenGranter(tokenServices, authorizationCodeServices, clientDetails,
requestFactory));
tokenGranters.add(new RefreshTokenGranter(tokenServices, clientDetails, requestFactory));
ImplicitTokenGranter implicit = new ImplicitTokenGranter(tokenServices, clientDetails, requestFactory);
tokenGranters.add(implicit);
tokenGranters.add(new ClientCredentialsTokenGranter(tokenServices, clientDetails, requestFactory));
tokenGranters.add(new ResourceOwnerPasswordTokenGranter(authenticationManager(), tokenServices,
clientDetails, requestFactory));
endpoints.tokenGranter(new CompositeTokenGranter(tokenGranters));
}
@Bean
public JwtTokenStore jwtTokenStore() {
return new JwtTokenStore(accessTokenConverter());
}
@Bean
public JwtAccessTokenConverter accessTokenConverter() {
JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
converter.setSigningKey("123");
return converter;
}
@Bean
@Primary
public DefaultTokenServices tokenServices() {
DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
defaultTokenServices.setTokenStore(jwtTokenStore());
defaultTokenServices.setSupportRefreshToken(true);
return defaultTokenServices;
}
public AuthenticationManager authenticationManager() {
List<AuthenticationProvider> providers = new ArrayList<>();
providers.add(daoAuthenticationProvider());
return new ProviderManager(providers, authenticationManager);
}
@Bean
public DaoAuthenticationProvider daoAuthenticationProvider() {
DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
authenticationProvider.setUserDetailsService(userService);
authenticationProvider.setPasswordEncoder(passwordEncoder());
return authenticationProvider;
}
@Bean
public PasswordEncoder passwordEncoder() {
return new Md5PasswordEncoder();
}
}
這個是security配置
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity
@Order(1)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
private UserService userService;
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.anonymous().disable()
.authorizeRequests()
.antMatchers( "/login").permitAll();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userService);
}
@Bean(name = BeanIds.AUTHENTICATION_MANAGER)
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
}
自己專案的controller
@RestController
public class TestController {
@RequestMapping(value = "/test",method = RequestMethod.GET)
public Object test(Authentication authentication){
String principal = (String) authentication.getPrincipal();
return new JsonResult(200,"success",principal);
}
}
uj5u.com熱心網友回復：
兩個放在同一個服務上，方法不需要任何認證就可以訪問，所以authentication也是null,但是分別放在兩個服務上，不加token會提示認證，加token后authentication可以獲取到用戶資訊@RestController
public class TestController {
@RequestMapping(value = "/test",method = RequestMethod.GET)
public Object test(Authentication authentication){
String principal = (String) authentication.getPrincipal();
return new JsonResult(200,"success",principal);
}
}
uj5u.com熱心網友回復：
也碰到這個問題。 原因應該是SecurityConfiguration的配置優先級比ResourceServerConfigurer 優先級高，導致請求首先被SecurityConfiguration攔截了。 解決方案是提高ResourceServerConfigurer的優先級(@order)比 SecurityConfiguration高， 或者讓SecurityConfiguration只處理oauth/路徑的請求，比如http.csrf().disable()..antMatcher("/oauth/**")..authorizeRequests()......uj5u.com熱心網友回復：
我現在有一個困惑， auth2只是做了用戶認證， 資源授權判斷怎么處理，是交給spring security，做決策嗎？如果是這樣的 話，springsecurity中的用戶認證怎么和auth2對應上uj5u.com熱心網友回復：
球博主的github地址uj5u.com熱心網友回復：
<br />請問解決了嗎？我也遇到了這個問題uj5u.com熱心網友回復：
<br />我也遇到了這個問題，請問您解決了嗎？uj5u.com熱心網友回復：
我遇到的問題是加了這個注解可以用密碼模式，不加注解可以用授權碼模式 頭大，卡了好幾天了轉載請註明出處，本文鏈接：https://www.uj5u.com/houduan/149261.html
標籤：Java EE
上一篇：如何使用JAVA實作對計算機上的不同用戶設定不同的檔案夾權限
下一篇：求助java安裝