令牌URL因Spring Security OAuth2而失败

Question

I'm trying to get a oauth2 configuration for securing my webapp and only allowing trusted clients with provided user credentials to access the app.

This is what I have so far

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xmlns:oauth="http://www.springframework.org/schema/security/oauth2" xmlns:sec="http://www.springframework.org/schema/security"
   xmlns:mvc="http://www.springframework.org/schema/mvc"
   xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
    http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">


    <http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
     xmlns="http://www.springframework.org/schema/security">
        <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
        <anonymous enabled="false" />
        <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
        <!-- include this only if you need to authenticate clients via request parameters -->
        <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" />
       <access-denied-handler ref="oauthAccessDeniedHandler" />
    </http>

    <!-- The OAuth2 protected resources are separated out into their own block so we can deal with authorization and error handling 
separately. This isn't mandatory, but it makes it easier to control the behaviour. -->
    <http request-matcher="regex" create-session="stateless" entry-point-ref="oauthAuthenticationEntryPoint"
      xmlns="http://www.springframework.org/schema/security">
        <!-- <anonymous enabled="false" /> -->
        <intercept-url pattern="/api/register/.*" access="ROLE_CLIENT" />
        <intercept-url pattern="/api/.*" access="ROLE_USER" />
        <access-denied-handler ref="oauthAccessDeniedHandler" />
        <expression-handler ref="oauthWebExpressionHandler" />
    </http>

    <bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
        <property name="realmName" value="qeep" />
    </bean>

    <bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
        <property name="realmName" value="qeep/client" />
    </bean>

   <bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />    

   <authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider user-service-ref="qeepUserDetailsService" />
   </authentication-manager>

   <bean id="myUserDetailsService" class="com.example.core.web.rest.auth.QeepUserDetailsService"/>

   <bean id="tokenStore" class="com.example.core.web.rest.auth.QeepTokenStore" />

   <bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
       <property name="tokenStore" ref="tokenStore" />
       <property name="supportRefreshToken" value="true" />
       <property name="clientDetailsService" ref="clientDetails" />
   </bean>

   <authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider user-service-ref="clientDetailsUserService" />
   </authentication-manager>

   <bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
       <constructor-arg ref="clientDetails" />
   </bean>

   <bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
       <property name="authenticationManager" ref="clientAuthenticationManager" />
   </bean>                

   <oauth:client-details-service id="clientDetails">
       <oauth:client client-id="my-trusted-client-with-secret" authorized-grant-types="password,authorization_code,refresh_token,implicit"
                  secret="somesecret" authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT" />
   </oauth:client-details-service>

   <oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices">
       <oauth:authorization-code />
       <oauth:implicit />
       <oauth:refresh-token />
       <oauth:client-credentials />
       <oauth:password />
   </oauth:authorization-server>

   <sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true">
       <!--you could also wire in the expression handler up at the layer of the http filters. See https://jira.springsource.org/browse/SEC-1452 -->
   <sec:expression-handler ref="oauthExpressionHandler" />
   </sec:global-method-security>

   <oauth:expression-handler id="oauthExpressionHandler" />

   <oauth:web-expression-handler id="oauthWebExpressionHandler" />
</beans>

If I access /oauth/token using curl, I get a client authorization request which I get through using the configured client credentials. But after this /oauth/token only returns 404 - Not found . I've tried different stuff for the last hours without any success.

I extracted the configuration from the sparklr/tonr sample of oauth2 1.0.5 which I used because we are still on spring 3.2.

The same test works fine in the sparklr-Sample-webapp.

EDIT

The actual curl url is the following:

curl -v -H "Authorization: Basic bXktdHJ1c3RlZC1jbGllbnQtd2l0aC1zZWNyZXQ6c29tZXNlY3JldA==" "http://localhost:8084/core/oauth/token"

Without the Authorization-Header I get a 401 asking for the client authentication as configured ("my-trusted-client-with-secret" and "somesecret") but with the added authorization header I just get the 404 - Not found. If I test the same with the sparklr-Sample I get an error asking for the grant-type after adding the Basic-Auth-Header like above which is what I would expect.

I hope this makes a bit clearer.

Any ideas what's wrong with my configuration?

Answer 1

The DispatcherServlet was mapped to the wrong url, I broke it while trying to fix an issue which I had first. The Dispatcher-Servlet is mapped to core/api and the token service first was mapped to core/api/oauth/token which I later changed to core/oauth/token but I forgot to change the DispatcherServlet. Thanks, Dave for the hint!