java – Spring安全性OAuth2刷新令牌 – IllegalStateException,
发布时间:2020-12-15 02:20:08 所属栏目:Java 来源:网络整理
导读:我是 Spring安全新手,并使用OAuth2身份验证和授权开发spring REST API.一切正常,但是当我请求刷新令牌时,我得到的错误是 – org.springframework.security.oauth2.provider.endpoint.TokenEndpoint handleException IllegalStateException,UserDetailsServic
我是
Spring安全新手,并使用OAuth2身份验证和授权开发spring REST API.一切正常,但是当我请求刷新令牌时,我得到的错误是 –
注意:我使用自定义身份验证提供程序来验证数据库中的用户凭据. 这是我的代码: Web安全配置适配器: @Configuration @EnableWebSecurity public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter { @Autowired private ClientDetailsService clientDetailsService; @Autowired private CustomAuthenticationProvider authProvider; @Override protected void configure( AuthenticationManagerBuilder auth) throws Exception { auth.authenticationProvider(authProvider); } @Override protected void configure(HttpSecurity http) throws Exception { http .csrf().disable() .anonymous().disable() .authorizeRequests() .antMatchers("/oauth/token").permitAll(); } @Override @Bean public AuthenticationManager authenticationManagerBean() throws Exception { return super.authenticationManagerBean(); } @Bean public TokenStore tokenStore() { return new InMemoryTokenStore(); } @Bean @Autowired public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){ TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler(); handler.setTokenStore(tokenStore); handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService)); handler.setClientDetailsService(clientDetailsService); return handler; } @Bean @Autowired public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception { TokenApprovalStore store = new TokenApprovalStore(); store.setTokenStore(tokenStore); return store; } } 自定义验证提供商 @Component public class CustomAuthenticationProvider implements AuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { String username = authentication.getName(); String password = authentication.getCredentials().toString(); Ss_admin_service ss_admin_service = new Ss_admin_service(); Ss_admin ss_admin = new Ss_admin(); ss_admin.setA_password(password); ss_admin.setA_username(username); ss_admin_service.doLogin(ss_admin); if(!ss_admin_service.doLogin(ss_admin)) { throw new BadCredentialsException("Invalid username/password"); } return new UsernamePasswordAuthenticationToken(username,password,(Collection<? extends GrantedAuthority>) new ArrayList<>()); } @Override public boolean supports(Class<?> authentication) { return authentication.equals(UsernamePasswordAuthenticationToken.class); } } 授权服务器配置 @Configuration @EnableAuthorizationServer public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter { private static String REALM="MY_OAUTH_REALM"; @Autowired private TokenStore tokenStore; @Autowired private UserApprovalHandler userApprovalHandler; @Autowired @Qualifier("authenticationManagerBean") private AuthenticationManager authenticationManager; @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception { clients.inMemory() .withClient("my-trusted-client") .authorizedGrantTypes("password","authorization_code","refresh_token","implicit") .authorities("ROLE_CLIENT","ROLE_TRUSTED_CLIENT") .scopes("read","write","trust") .secret("secret") .accessTokenValiditySeconds(10).//Access token is only valid for 10 sec for testing. refreshTokenValiditySeconds(10);//Refresh token is only valid for 10 sec for testing. } @Override public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler) .authenticationManager(authenticationManager); } @Override public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception { oauthServer.realm(REALM+"/client"); } } 资源服务器配置 @Configuration @EnableResourceServer public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter { private static final String RESOURCE_ID = "SPRING_REST_API"; @Override public void configure(ResourceServerSecurityConfigurer resources) { resources.resourceId(RESOURCE_ID).stateless(false); } @Override public void configure(HttpSecurity http) throws Exception { http .anonymous().disable() .requestMatchers().antMatchers("/admin/**") .and().authorizeRequests() .antMatchers("/admin/**").access("hasRole('ADMIN')") .and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler()); } } 解决方法
您可以尝试将ClientDetailsS??ervice注入Authorization Server Config并将其配置如下;
授权服务器配置 ..... @Autowired private ClientDetailsService clientDetailsService; ...... ...... @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception { clients.withClientDetails(clientDetailsService); } (编辑:李大同) 【声明】本站内容均来自网络,其相关言论仅代表作者个人观点,不代表本站立场。若无意侵犯到您的权利,请及时与联系站长删除相关内容! |