[英]Spring Security OAuth 2.0 with no client_secret
I am developing a login system for my Android application using Spring Boot and Spring Security OAuth 2.0. 我正在使用Spring Boot和Spring Security OAuth 2.0为我的Android应用程序开发登录系统。
My starting point is the following demo repository: https://github.com/royclarkson/spring-rest-service-oauth . 我的起点是以下演示存储库: https : //github.com/royclarkson/spring-rest-service-oauth 。 In the demo you can find the following setup:
在演示中,您可以找到以下设置:
OAuth2 client: OAuth2客户端:
clients
.inMemory()
.withClient("clientapp")
.authorizedGrantTypes("password", "refresh_token")
.authorities("USER")
.scopes("read", "write")
.resourceIds(RESOURCE_ID)
.secret("123456");
Method to fetch the access token in its tests: 在其测试中获取访问令牌的方法:
private String getAccessToken(String username, String password) throws Exception {
String authorization = "Basic " + new String(Base64Utils.encode("clientapp:123456".getBytes()));
String content = mvc
.perform(
post("/oauth/token")
.header("Authorization", authorization)
.contentType(MediaType.APPLICATION_FORM_URLENCODED)
.param("username", username)
.param("password", password)
.param("grant_type", "password")
.param("scope", "read write")
.param("client_id", "clientapp")
.param("client_secret", "123456"))
.andExpect(status().isOk())
.andReturn().getResponse().getContentAsString();
return content.substring(17, 53);
}
Every test in the project provides works perfectly but I want do things differently and I am having trouble doing so. 项目中的每个测试都能完美地完成工作,但是我想以不同的方式做事,我在这样做时遇到了麻烦。 As you can see the demo client defines a
client_secret
(which is also used in the tests) but a client_secret
is really worthless in an Android environment, I can not guarantee its 'privateness'. 如您所见,演示客户端定义了一个
client_secret
(也在测试中使用),但是client_secret
在Android环境中确实毫无价值,我不能保证它的“私密性”。
See https://apigility.org/documentation/auth/authentication-oauth2 : 参见https://apigility.org/documentation/auth/authentication-oauth2 :
If we are using a public client (by default, this is true when no secret is associated with the client) you can omit the client_secret value;
如果我们使用的是公共客户端(默认情况下,当没有秘密与客户端关联时,则为true),则可以省略client_secret值;
and see http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-2.1 : 并参见http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-2.1 :
Public: Clients incapable of maintaining the confidentiality of their credentials (eg clients executing on the device used by the resource owner such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.
公用:无法维护其凭据的机密性的客户端(例如,在资源所有者使用的设备上执行的客户端,例如已安装的本机应用程序或基于Web浏览器的应用程序),并且无法通过任何其他方式进行安全的客户端身份验证。
So what I have done is removing the secret in the client configuration: 因此,我要做的是删除客户端配置中的秘密:
clients
.inMemory()
.withClient("books_password_client")
.authorizedGrantTypes("password", "refresh_token")
.authorities("USER")
.scopes("read", "write")
.resourceIds(RESOURCE_ID);
Also adapted the getAccessToken(...)
method: 还改编了
getAccessToken(...)
方法:
private String getAccessToken(String username, String password) throws Exception {
String authorization = "Basic " + new String(Base64Utils.encode("books_password_client:123456".getBytes()));
String content = mvc
.perform(
post("/oauth/token")
.contentType(MediaType.APPLICATION_FORM_URLENCODED)
.param("username", username)
.param("password", password)
.param("grant_type", "password")
.param("client_id", "books_password_client"))
.andExpect(status().isOk())
.andReturn().getResponse().getContentAsString();
return content.substring(17, 53);}
}
But when I use this new setup my tests fail, I can't get an access token, I keep getting an HTTP error 401 Unauthorized. 但是,当我使用这个新设置时,我的测试失败了,我无法获得访问令牌,并且不断收到HTTP错误401未经授权。
This is what I have working: 这是我的工作:
Response response =
given().
auth()
.preemptive().basic("clientapp", "")
.formParam("username", username)
.formParam("password", password)
.formParam("grant_type", "password")
.formParam("scope", "read%20write")
when()
.post("/oauth/token").
then()
.extract().response();
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.