使用Spring oauth2使用OAuth安全的REST Web服务

Question

我想从服务器使用REST Web服务,该服务器使用oauth2保护其资源.

我使用Spring boot(JHipster).

要做到这一点,我在SecurityConfiguration课堂上这样:

@Value("${oauth.resource:http://sercverUsingOAuth2}")
private String baseUrl;

@Value("${oauth.authorize:http://sercverUsingOAuth2/rest/oauth/token}")
private String authorizeUrl;

@Value("${oauth.token:http://sercverUsingOAuth2/rest/oauth/token}")
private String tokenUrl;

@Bean
public OAuth2RestOperations oauth2RestTemplate() {
    AccessTokenRequest atr = new DefaultAccessTokenRequest();
    return new OAuth2RestTemplate(resource(),
            new DefaultOAuth2ClientContext(atr));
}

@Bean
protected OAuth2ProtectedResourceDetails resource() {
    AuthorizationCodeResourceDetails resource = new AuthorizationCodeResourceDetails();
    resource.setAccessTokenUri(tokenUrl);
    resource.setUserAuthorizationUri(authorizeUrl);
    resource.setClientId("client_id");
    resource.setClientSecret("client_secret");
    resource.setGrantType("grant_type");
    return resource;
}

这个class(SecurityConfiguration)使用以下方法进行注释:

@Configuration
@EnableWebSecurity
@EnableOAuth2Client

这是我的controller(Spring MVC):

@RestController
@RequestMapping("/consume")
public class MyContrtoller {

@Inject
private OAuth2RestOperations oauth2RestTemplate;

@RequestMapping(value = "/oauth2", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
public List<DataModel> getProducts() {

    ResponseEntity<MyModel> forEntity = oauth2RestTemplate
            .getForEntity("http://sercverUsingOAuth2/rest/resourceToConsume",
                    MyModel.class);
    return forEntity.getBody().getData();
}

}

但是当我想要使用我的webservice(http:// myHost/consume/oauth2)时,我得到了这个例外:

    org.springframework.security.oauth2.client.resource.OAuth2AccessDeniedException:
 Unable to obtain a new access token for resource 'null'. The provider manager
 is not configured to support it.

我用Google搜索,我发现了这个:

• github上
• 堆栈溢出

但它对我没有帮助.

谢谢.

Answer 1

您使用的是授权网址和令牌网址的相同网址.这是我的第一个线索,然后我看到了你的评论.

即使您正在更改授权类型,当您应该使用"ClientCredentialsResourceDetails"时,仍然使用"AuthorizationCodeResourceDetails".这种类型的ResourceDetails适用于您要解释的情况.

ClientCredentialsResourceDetails resource = new ClientCredentialsResourceDetails();
resource.setAccessTokenUri(TOKEN_URL);
resource.setClientId(CLIENT_ID);
resource.setClientSecret(CLIENT_SECRET);
resource.setClientAuthenticationScheme(AuthenticationScheme.form); //This line isn't always needed
return resource;