带有表单登录的Spring Boot Security OAuth2

Question

我遵循Spring Boot Security入门的第V部分来保护我的RESTful微服务.

我打算实施的简单流程是: -

1. 如果未经身份验证,则会将用户重定向到自定义登录页面,例如"/ login".

2. 用户提供他的凭据.

3. 成功验证后,用户将被重定向到主页('/ home').在请求中提供访问令牌后,我应该能够访问我的REST端点(在Zuul代理服务器后面).

上述链接中的"入门指南"使用在.properties或.yml文件中配置的Basic Auth和虚拟用户.

这是我尝试配置的方式: -

@Configuration
@EnableAuthorizationServer
public class OAuth2Config extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory().withClient("acme").secret("acmesecret")
                .authorizedGrantTypes("authorization_code", "refresh_token", "password").scopes("openid")
                .accessTokenValiditySeconds(3600);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.tokenKeyAccess("isAnonymous()").checkTokenAccess("isAnonymous()")
                .allowFormAuthenticationForClients();
    }

}



@Configuration
@Import({ OptoSoftSecurityServiceConfig.class })
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService; // backed by MongoDB

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.httpBasic().disable().formLogin();// disabled basic auth and configured to use dafault Spring Security form login.
    }
}

命中授权端点会将我重定向到' http:// localhost:9999/uaa/login ',并显示错误消息: -

<oauth>
<error_description>
Full authentication is required to access this resource
</error_description>
<error>unauthorized</error>
</oauth>

问题

1. 如何配置Authorization Server以使用UserDetailsS​​ervice而不是静态用户,并使用Form Login而不是Basic Auth.

2. 如何在使用'authorization_code'作为授权类型时配置自动批准？

3. 是否必须通过Basic Auth保护/ oauth/authorize端点？为什么"需要完全身份验证"才能访问/ oauth/authorize'端点.我相信在此端点之前我们不知道谁是用户.只有在使用表单登录后出现的有效凭据对用户进行身份验证后,才能识别用户.

Answer 1

终于成功了。提到的博客中的 git 存储库已经配置了这个东西。事实证明这非常简单。

这对我有用（我还将自动批准配置为 true）：-

**
 * @author kumar
 *
 */
@SpringBootApplication
public class AuthenticationServerApplication {

    /**
     * @param args
     */
    public static void main(String[] args) {
        SpringApplication.run(AuthenticationServerApplication.class, args);

    }

    @Configuration
    protected static class LoginConfig extends WebSecurityConfigurerAdapter {

        @Autowired
        private AuthenticationManager authenticationManager;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.formLogin().permitAll().and().authorizeRequests().anyRequest().authenticated();//.and().userDetailsService(yourCustomerUserDetailsService);
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.parentAuthenticationManager(authenticationManager);
        }
    }

    @Configuration
    @EnableAuthorizationServer
    protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private AuthenticationManager authenticationManager;

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.authenticationManager(authenticationManager);
        }

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory().withClient("acme").secret("acmesecret")
                    .authorizedGrantTypes("authorization_code", "refresh_token", "password").scopes("openid")
                    .autoApprove(true);
        }

        @Override
        public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
            oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
        }

    }

}

application.yml：-

  security:
      user:
        password: password
    server:
      port: 9999
      context-path: /uaa