[英]Spring Security oauth 2 Disable Client authentification on TokenEndPoint with grant_type “password”
My application use a Spring Security Oauth2 configuration to manage the authentification. 我的应用程序使用Spring Security Oauth2配置来管理认证。
Currently, my request need those info: grand_type, username, password, client_id and client_secret. 当前,我的请求需要这些信息:grand_type,用户名,密码,client_id和client_secret。
But, I don't need the client authentification (client_id + client_secret) for my application. 但是,我不需要我的应用程序的客户端身份验证(client_id + client_secret)。 So, how i remove this authentification?
因此,我如何删除此身份验证?
Here is my current configuration: 这是我当前的配置:
AuthorizationServerConfigurerAdapter: AuthorizationServerConfigurerAdapter:
@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
@Autowired
private TokenStore tokenStore;
@Autowired
private UserApprovalHandler userApprovalHandler;
@Autowired
@Qualifier("authenticationManagerBean")
private AuthenticationManager authenticationManager;
@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory()
.withClient("khk")
.autoApprove(true)
.authorizedGrantTypes("refresh_token", "password")
.authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
.scopes("openid")
//.secret("changeme")
.accessTokenValiditySeconds(30000)
.refreshTokenValiditySeconds(60000);
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.tokenStore(tokenStore).userApprovalHandler(userApprovalHandler)
.authenticationManager(authenticationManager).pathMapping("/oauth/token", "/connect").accessTokenConverter(accessTokenConverter());
}
public AccessTokenConverter accessTokenConverter() {
return new DefaultAccessTokenConverter();
}
@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
}
}
WebSecurityConfigurerAdapter: WebSecurityConfigurerAdapter:
@Configuration
@EnableWebSecurity
public class OAuth2SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
private ClientDetailsService clientDetailsService;
@Autowired
private DataSource dataSource;
@Autowired
public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
auth.jdbcAuthentication().dataSource(dataSource)
.usersByUsernameQuery("select us_pseudo, us_passwd, us_enabled from t_user where us_pseudo=?")
.authoritiesByUsernameQuery("select us.us_pseudo, gr.name from t_user us, t_group gr, r_groupuser gu where us.us_id = gu.groupuser_user_id and gr.gp_id = gu.groupuser_group_id and us.us_pseudo = ?");
//.groupAuthoritiesByUsername("TO DO FOR RIGHTS");
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
@Bean
@Autowired
public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
handler.setTokenStore(tokenStore);
handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
handler.setClientDetailsService(clientDetailsService);
return handler;
}
@Bean
@Autowired
public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
TokenApprovalStore store = new TokenApprovalStore();
store.setTokenStore(tokenStore);
return store;
}
}
ResourceServerConfigurerAdapter: ResourceServerConfigurerAdapter:
@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
private static final String RESOURCE_ID = "SPRING_REST_API";
@Override
public void configure(ResourceServerSecurityConfigurer resources) {
resources.resourceId(RESOURCE_ID).stateless(false);
}
@Override
public void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers(HttpMethod.POST, "/connect").permitAll()
.anyRequest().permitAll()
.and()
.exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
}
}
The short answer is: you need that information to use oauth2 . 简短的答案是: 您需要该信息才能使用oauth2 。 It's not optional information that you can just remove and get everything working.
它不是可选信息,您可以删除所有信息并使它们正常运行。
Remember that the purpose of the client_id and the client_secret is to authorize your client app itself. 请记住,client_id和client_secret的目的是授权您的客户端应用程序本身。 Depending on the grant type you are using your client app will need just the client_id or both.
根据所使用的授予类型,您将使用客户端应用程序仅需要client_id或两者都需要。
If you want just the client_id you could choose between the Autorization Code or the Implicit grant type. 如果只需要client_id,则可以在“ 自动代码”或“ 隐式”授予类型之间进行选择。 But first I would recommend to read this article to understand the different grant types and determine which one best suits in your case.
但是首先,我建议阅读本文以了解不同的赠款类型,并确定哪种最适合您的情况。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.