Spring Security的@EnableWebSecurity vs oauth的@EnableResourceServer

Question

我有一个使用Spring Boot,Angular 2,Spring OAuth 2的系统,我使用@EnableWebSecurity实现了安全性,并在同一个应用程序中使用@EnableResourceServer和@EnableAuthorizationServer实现了oauth.

以下是已实现的类:

SecurityConfig.java

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {


    @Autowired
    private ClientDetailsService clientDetailsService;

    @Autowired
    public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("user").password("pass").roles("USER").and()
                .withUser("username").password("password").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/private/**").hasRole("USER")
                .antMatchers("/public/**").permitAll();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

AuthorizationServerConfig.java

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        clients.inMemory()
                .withClient("my-trusted-client")
                .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT","USER")
                .scopes("read", "write", "trust")
                .secret("secret")
                .accessTokenValiditySeconds(1200).
                refreshTokenValiditySeconds(6000);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.checkTokenAccess("hasAuthority('USER')");
    }

}

ResourceServerConfig.java

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter{

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/public/**").permitAll();
        http.authorizeRequests().antMatchers("/private/**").hasRole("USER");
    }
}

任何用户都可以访问/ public后面的所有url ; 这是正确的./ private /后面的URL 由ResourceServerConfig和SecurityConfig保护,因此匿名用户无法访问它.当我使用grant_type = password从授权服务器请求access_token时,通过附加access_token作为参数,我获得了用于访问安全资源的access_token.但仍然没有资源,我收到如下响应:

localhost:8080/private/user/test/?access_token=92f9d86f-83c4-4896-a203-e21976d4cfa2    

{
    "timestamp": 1495961323209,
    "status": 403,
   "error": "Forbidden",
   "message": "Access Denied",
   "path": "/private/user/test/"
}

但是当我从SecurityConfig.configure(HttpSecurity)中删除antMatchers时,即使ResourceServerConfig.configure(HttpSecurity)正在保护模式,资源也不再受到保护.

我的问题:

• 我是否需要在ResourceServerConfig中执行任何操作以便从资源服务器授予对授权用户的访问权限？
• @EnableResourceServer和@EnableWebSecurity之间有什么区别？我是否需要在此应用程序中实现两者？(我对这个问题找不到任何好的答案)

Answer 1

您的私有资源受到很好的保护，但获得的access_token未以正确的方式传递到服务器。

您必须将其作为请求的标头传递

 Authorization: Bearer 92f9d86f-83c4-4896-a203-e21976d4cfa2

或作为curl命令：

 curl -H "Authorization: Bearer 92f9d86f-83c4-4896-a203-e21976d4cfa2"